From f14ea6c57708635179fe72e357afb8b5f85a8360 Mon Sep 17 00:00:00 2001
From: Arc <33088785+arcbtc@users.noreply.github.com>
Date: Fri, 17 Apr 2026 12:50:26 +0100
Subject: [PATCH] fix: add auth_https_only to env.example (#3937)

---
 .env.example | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index e74b8d0d1..baee6e85b 100644
--- a/.env.example
+++ b/.env.example
@@ -7,9 +7,13 @@
 # They are NOT managed by the Admin UI and are not stored in the database.
 
 # === First Install Token ===
-# if set the user is required to enter this token on the /first_install page
+# If set the user is required to enter this token on the /first_install page
 # FIRST_INSTALL_TOKEN="myaccesstoken"
 
+# === Security ===
+# When enabled (recommended), auth cookies require HTTPS and SSO will reject insecure HTTP.
+AUTH_HTTPS_ONLY=true
+
 # === Logging and Development ===
 
 DEBUG=False