FOSSBilling 安全配置

FOSSBilling 配置

以下文档 config.php 配置文件下的安全选项。

配置属性	默认值	允许值	描述
`mode`	`strict`	`strict`or `regular`	Setting this to `strict`sets cookies to have their `samesite`attribute set to `strict`and they will be set as `httpOnly`. Setting it to `regular`will use the default cookie properties except that they will still be set as `httpOnly`.
`force_https`	`true`	`bool`	Setting this to `true` will cause FOSSBilling to redirect all requests to HTTPS and force cookies to only be sent over HTTPS.
`cookie_lifespan`	`7200`	`int`	This property configures the number of seconds that cookies and session is considered valid for. After this time period, they will expire and be destroyed. The default configuration is `7200`seconds (2 hours).

'security' => [	'mode' => 'strict',	'force_https' => true,	'cookie_lifespan' => 7200,],

配置属性	默认值	允许值	描述
`CSRFPrevention`	`true`	`bool`	Enables or disables the usage of a CSRF protection system. This should be enabled at all times unless it is specifically causing issues.

'api' => [	'CSRFPrevention' => true,],

由于反向代理通常的工作方式，使用它通常会让 FOSSBilling 认为它是在没有 HTTPS 的情况下访问的。要解决这个问题，只需确保您的反向代理正在转发 X-Forwarded-Proto 标头，并且它已正确设置为 https。

更新 2025-11-20

您的感觉是什么