1.0.0-rc.1 · Release Candidate1 min read
Security Header Configuration
Configure the security boundary around URLs, cookies, origins, and reverse-proxy headers.
Security configuration spans secure cookie behavior, CORS allowed origins, API documentation exposure, proxy forwarding, TLS, and response headers. AUTH_COOKIE_SECURE, CORS_ALLOWED_ORIGINS, and ENABLE_API_DOCS are source-validated controls; real edge policy remains deployment configuration.
Verification
Exercise the configured origin and cookie behavior over the intended TLS boundary, confirm API docs exposure is deliberate, and check headers on web, admin, and API responses. Do not publish real domains or header secrets.
Related articles
Domain and URL ConfigurationConfigure public, admin, API, CORS, and callback URL boundaries using external operator-owned values.TLS RequirementsDocument the external TLS boundary for AutoCore without claiming a built-in certificate authority or deployment.Security and Configuration BoundariesUnderstand AutoCore authentication, authorization, installation, edition, configuration, and external-service boundaries.