Closed btmo closed 3 months ago
I was going through https://hexdocs.pm/phoenix/using_ssl.html to set up SSL for a Phoenix service. According to the documentation:
It is important to note that force_ssl: is a compile time config, so it normally is set in prod.exs, it will not work when set from runtime.exs.
Sobelow currently warns when runtime.exs contains https settings but no force_ssl. This PR suggests to ignore the runtime.exs file when checking HSTS.
runtime.exs
https
force_ssl
Change makes total sense to me - thanks for the thorough PR!
I was going through https://hexdocs.pm/phoenix/using_ssl.html to set up SSL for a Phoenix service. According to the documentation:
Sobelow currently warns when
runtime.exs
containshttps
settings but noforce_ssl
. This PR suggests to ignore theruntime.exs
file when checking HSTS.