Skip to content

Renames "Auth Tokens" section to "Authorized Domains" #89

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
djperrefort merged 1 commit into from
Oct 1, 2026
Merged

Renames "Auth Tokens" section to "Authorized Domains" #89

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions docs/deploy/configure/api_settings.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,19 +40,19 @@ When using a reverse proxy for TLS, the settings below can be left at their defa
| `SECURE_HSTS_SUBDOMAINS` | `False` | Enable HSTS for subdomains. |
| `SECURE_HSTS_PRELOAD` | `False` | Enable HSTS preload functionality. |

### Auth Tokens
### Authorized Domains

The following settings define which domains are allowed to interact with the API server.
These settings should be made as restrictive as possible, helping prevent unauthorized
access to the API.

| Setting Name | Default Value <br/><br/> | Description |
|--------------------------|-------------------------------------------------|--------------------------------------------------------------------------------------------------|
| `SECURE_SSL_TOKENS` | `False` | Only issue session/CSRF tokens over secure connections. |
| `SECURE_ALLOWED_HOSTS` | <code>localhost,127.0.0.1</code> | Comma-separated list of api host/domain names (**without** protocol). |
| `SECURE_ALLOWED_ORIGINS` | _See default local addresses._ | Comma-separated list of accepted client origin domains (**with** protocol). |
| `SECURE_SESSION_AGE` | `1209600` (2 weeks) | Number of seconds before session tokens expire. |
| `SECURE_TOKEN_DOMAIN` | None | Domain attribute for session/csrf cookies. Set for cross-subdomain usage (e.g., `.example.com`). |
| Setting Name | Default Value <br/><br/> | Description |
|--------------------------|-------------------------------------------------|------------------------------------------------------------------------------------------------------|
| `SECURE_SSL_TOKENS` | `False` | Only issue session/CSRF tokens over secure connections. |
| `SECURE_ALLOWED_HOSTS` | <code>localhost,127.0.0.1</code> | Comma-separated list of api host/domain names (**without** protocol). |
| `SECURE_ALLOWED_ORIGINS` | _See default local addresses._ | Comma-separated list of accepted client origin domains (**with** protocol). |
| `SECURE_SESSION_AGE` | `1209600` (2 weeks) | Number of seconds before session tokens expire. |
| `SECURE_TOKEN_DOMAIN` | None | The domain attribute for session/csrf cookies. Set for cross-subdomain usage (e.g., `.example.com`). |

In most deployments, the settings above should be configured as follows:

Expand Down
Loading