Release v1.24.0

Release v1.24.0

Changelog

Security

• Password-reset poisoning hardening — new absolute_url.base_uri (nullable, default null; e.g. '%env(DEFAULT_URI)%'). When set, every absolute URL that leaves the request is built against that fixed origin (scheme, host, port, path prefix) instead of the incoming Host header: password-reset link and reset-code page link, magic-login link (Symfony LoginLinkHandler, {_locale} kept), QR login approve URL, and the social-login OAuth redirect_uri (start and code exchange). A forged Host on the reset / magic request no longer reaches the victim's email. null keeps the previous behaviour exactly; then configure framework.trusted_hosts (see docs/SECURITY.md).

Added

• Nowo\AuthKitBundle\Routing\AbsoluteUrlGenerator — wraps the router, applies a RequestContext built from base_uri for one generation (generate() / withBaseContext()) and restores the original context in finally (FrankenPHP worker-safe). AuthKitUrlGenerator routes ABSOLUTE_URL / NETWORK_PATH through it; relative paths are unchanged.
• base_uri is validated (absolute http(s) URL, no user info / query / fragment) at compile time for literals and at service construction for %env()% values (empty env = disabled).

Full Changelog: v1.23.1...v1.24.0