feat: harden the myep oauth2 client

2026-09-23 16:06:25 +02:00
parent 2a8649fc6d
commit 3f4586ce06
8 changed files with 284 additions and 11 deletions
@@ -49,6 +49,11 @@ MAILING_MAILER_DSN=null://null

 APP_BASE_URI=https://myep-team.ddev.site

+# Regex matched against the Host header; requests for any other host are refused. The
+# OAuth2 redirect_uri is generated from the request, so this is what pins it. Production
+# sets its own value outside the repository, like APP_BASE_URI above.
+APP_TRUSTED_HOSTS=^myep-team\.ddev\.site$
+
 APP_BPN_USER=
 APP_BPN_PASSWORD=
 APP_BPN_IP=