5abf984df2
WebauthnService::available() keyed on request()->isSecure(), which is false in external-proxy mode (the forwarded https scheme isn't trusted without TRUSTED_PROXY_CIDR) — so hardware keys were locked even though the panel runs over HTTPS on the domain. Gate on being reached via the active domain instead (always HTTPS through the front door); the bare-IP recovery host stays locked. A core security feature no longer depends on an optional proxy setting. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| .gitkeep | ||
| DeploymentService.php | ||
| Fail2banService.php | ||
| FirewallService.php | ||
| FleetService.php | ||
| HardeningService.php | ||
| MaintenanceService.php | ||
| SessionService.php | ||
| SshKeyProvisioner.php | ||
| WebauthnService.php | ||