# see https://symfony.com/doc/current/reference/configuration/framework.html
framework:
    secret: '%env(APP_SECRET)%'

    # Note that the session will be started ONLY if you read or write from it.
    session:
        cookie_secure: true       # HTTPS only (ddev + prod behind Traefik are both HTTPS)
        cookie_samesite: lax      # blunt CSRF on stateful surfaces (e.g. Twig payment pages)
        cookie_httponly: true

    # Behind Coolify/Traefik reverse proxy. TRUSTED_PROXIES is empty by default
    # (local/ddev) and set to the Docker network range in production.
    trusted_proxies: '%env(default::TRUSTED_PROXIES)%'
    trusted_headers: ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port']

    #esi: true
    #fragments: true

when@test:
    framework:
        test: true
        session:
            storage_factory_id: session.storage.factory.mock_file