feat: implement Content-Security-Policy for admin SPA and enhance session cookie security

2026-07-19 21:00:32 +03:30
parent e670b38821
commit 6275b3da1e
8 changed files with 359 additions and 5 deletions
@@ -3,7 +3,10 @@ framework:
    secret: '%env(APP_SECRET)%'

    # Note that the session will be started ONLY if you read or write from it.
-    session: true
+    session:
+        cookie_secure: true       # HTTPS only (ddev + prod behind Traefik are both HTTPS)
+        cookie_samesite: lax      # blunt CSRF on stateful surfaces (e.g. Twig payment pages)
+        cookie_httponly: true

    # Behind Coolify/Traefik reverse proxy. TRUSTED_PROXIES is empty by default
    # (local/ddev) and set to the Docker network range in production.