Skip to main content

​
Configure TLS and exact origins

Origin validation prevents provider credentials and approval sessions from being sent to an unreviewed service. Live mode therefore pins every Perflo service, including its path, and production requires HTTPS for application and Vault traffic.

​
Use reviewed Perflo origins

Set:
The validator rejects changes to scheme, host, port, user information, or base path. Hosted connection, approval, Know Your Customer, and card reveal URLs receive the same exact-origin validation before the browser sees them.

​
Protect application origins

Production requires HTTPS NEOBANK_PUBLIC_ORIGIN and NEOBANK_API_ORIGIN. The single-server deployment uses one origin behind Caddy. Cross-site request forgery protection also checks the exact origin on unsafe cookie-authenticated requests. Loopback live development can use HTTP application origins only when debug authentication is explicitly enabled. This exception does not apply to Perflo service origins.

​
Protect Vault traffic

Production requires an HTTPS NEOBANK_VAULT_ADDR. The server Compose path runs Vault with a certificate for vault and mounts its CA into every Python workload. Cleartext Vault transport is rejected because provider access and refresh credentials pass through the Transit API.