feat: harden the myep OAuth2 login

config/packages/framework.yaml

@@ -2,8 +2,31 @@
 framework:
     secret: '%env(APP_SECRET)%'
 
+    # The OAuth2 redirect_uri is generated from the incoming request, so the Host and the
+    # X-Forwarded-* headers decide where myep is told to send the authorization code. Both lists
+    # read the standard SYMFONY_* variables Symfony already defaults to, and are spelled out here
+    # because leaving them implicit is what made them easy to overlook. Set SYMFONY_TRUSTED_HOSTS
+    # per environment -- an empty value means every Host header is accepted.
+    trusted_hosts: '%env(default::SYMFONY_TRUSTED_HOSTS)%'
+    # Only ever needed behind a TLS-terminating proxy. Without it the generated redirect_uri of
+    # such a deployment comes out as http://, and the flow breaks rather than downgrading quietly.
+    trusted_proxies: '%env(default::SYMFONY_TRUSTED_PROXIES)%'
+    trusted_headers: ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'x-forwarded-prefix']
+
     # Note that the session will be started ONLY if you read or write from it.
-    session: true
+    #
+    # Everything here is pinned rather than left to the default, because a session cookie is the
+    # whole of this application's authentication once the OAuth2 flow is over. cookie_secure and
+    # cookie_samesite happen to match the defaults; save_path does not, and it is the one that
+    # matters in production -- deploy.php shares var/sessions between releases, and without this
+    # sessions land in PHP's default directory and every release logs everybody out.
+    session:
+        handler_id: session.handler.native_file
+        save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
+        name: epsession
+        cookie_secure: true
+        cookie_samesite: lax
+        cookie_httponly: true
 
     form:
         csrf_protection: