46 lines
2.3 KiB
YAML
46 lines
2.3 KiB
YAML
# see https://symfony.com/doc/current/reference/configuration/framework.html
|
|
framework:
|
|
secret: '%env(APP_SECRET)%'
|
|
|
|
# The OAuth2 redirect_uri is generated from the incoming request, so the Host and the
|
|
# X-Forwarded-* headers decide where myep is told to send the authorization code. Both lists
|
|
# read the standard SYMFONY_* variables Symfony already defaults to, and are spelled out here
|
|
# because leaving them implicit is what made them easy to overlook. Set SYMFONY_TRUSTED_HOSTS
|
|
# per environment -- an empty value means every Host header is accepted.
|
|
trusted_hosts: '%env(default::SYMFONY_TRUSTED_HOSTS)%'
|
|
# Only ever needed behind a TLS-terminating proxy. Without it the generated redirect_uri of
|
|
# such a deployment comes out as http://, and the flow breaks rather than downgrading quietly.
|
|
trusted_proxies: '%env(default::SYMFONY_TRUSTED_PROXIES)%'
|
|
trusted_headers: ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'x-forwarded-prefix']
|
|
|
|
# Note that the session will be started ONLY if you read or write from it.
|
|
#
|
|
# Everything here is pinned rather than left to the default, because a session cookie is the
|
|
# whole of this application's authentication once the OAuth2 flow is over. cookie_secure and
|
|
# cookie_samesite happen to match the defaults; save_path does not, and it is the one that
|
|
# matters in production -- deploy.php shares var/sessions between releases, and without this
|
|
# sessions land in PHP's default directory and every release logs everybody out.
|
|
session:
|
|
handler_id: session.handler.native_file
|
|
save_path: '%kernel.project_dir%/var/sessions/%kernel.environment%'
|
|
name: epsession
|
|
cookie_secure: true
|
|
cookie_samesite: lax
|
|
cookie_httponly: true
|
|
|
|
form:
|
|
csrf_protection:
|
|
# Symfony defaults this to {data-controller: csrf-protection}, which only made sense
|
|
# while the stateless CSRF Stimulus controller existed. We use plain session-backed
|
|
# tokens, so the hidden field needs no attributes at all.
|
|
field_attr: {}
|
|
|
|
#esi: true
|
|
#fragments: true
|
|
|
|
when@test:
|
|
framework:
|
|
test: true
|
|
session:
|
|
storage_factory_id: session.storage.factory.mock_file
|