Network boundaries and security
Listeners, codecs and handlers enforce different boundaries. TLS does not authorize users; HTTP parsing does not validate business fields.
Listener
Section titled “Listener”Bind internal services to loopback/private interfaces. Configure reverse-proxy body/time limits for public HTTP endpoints. TLS stream context needs server certificates/keys; outbound connections must validate peer certificates and names. Do not disable verify_peer to bypass trust failures.
Messages
Section titled “Messages”Bound maxPackageSize/maxSendBufferSize and frame/idle/TLS-handshake timeouts. Validate types and lengths after decoding. Never deserialize untrusted objects through unrestricted unserialize. Resolve file responses inside authorized storage after access checks.
Configure Request::trustedProxies for actual proxies only. Host and forwarding headers are not inherently trusted. Cookie sessions need Secure/HttpOnly/SameSite, CSRF protection and identifier rotation on login. Handle session persistence failures before returning success.
Operations
Section titled “Operations”Run workers as a dedicated user and keep secrets/uploads outside the public root. Log request/connection IDs and error reasons without tokens/cookies. Bound login attempts and connections at the public edge.