v0.2.25

src/routes/auth.rs

@@ -169,12 +169,7 @@ fn peer_ip(extensions: &axum::http::Extensions) -> IpAddr {
         .unwrap_or(IpAddr::V4(Ipv4Addr::LOCALHOST))
 }
 
-/// Whether issued/cleared session cookies carry the `Secure` attribute.
-///
-/// `cookie_secure = "auto"` (default) marks cookies `Secure` only when the
-/// browser actually reached RustBox over HTTPS, so plain-HTTP installations
-/// keep working: a `Secure` cookie sent over HTTP is discarded by browsers and
-/// the user could never stay logged in.
+/// Whether session cookies get `Secure` (`auto`: only when reached over HTTPS).
 pub(crate) fn cookie_secure(
     config: &AppConfig,
     extensions: &axum::http::Extensions,
@@ -187,11 +182,7 @@ pub(crate) fn cookie_secure(
     }
 }
 
-/// RustBox itself serves plain HTTP, so HTTPS can only be terminated in front
-/// of it. A scheme reported by a trusted reverse proxy (`X-Forwarded-Proto`,
-/// `Forwarded: proto=`, `X-Forwarded-Ssl`) wins; otherwise the scheme of the
-/// browser-supplied `Origin`/`Referer` is used. A forged header can only change
-/// the cookies issued to the client that forged it.
+/// Request scheme: trusted proxy headers first, then the browser `Origin`/`Referer`.
 fn request_is_https(
     config: &AppConfig,
     extensions: &axum::http::Extensions,