feat: harden the myep oauth2 client

2026-09-23 16:06:25 +02:00
parent 2a8649fc6d
commit 3f4586ce06
8 changed files with 284 additions and 11 deletions
@@ -5,6 +5,11 @@ framework:
    http_method_override: false
    handle_all_throwables: true

+    # The OAuth2 redirect_uri handed to MyE&P is generated from the incoming request, so an
+    # unvalidated Host header would let a crafted request point the authorization code
+    # somewhere else. Regex patterns, matched against the host without the scheme or port.
+    trusted_hosts: ['%env(APP_TRUSTED_HOSTS)%']
+
    # Enables session support. Note that the session will ONLY be started if you read or write from it.
    # Remove or comment this section to explicitly disable session support.
    session: