From 857fbb3d94cb0ffc1cbe72972ad8c48397df05ec Mon Sep 17 00:00:00 2001 From: Alex Yang Date: Mon, 9 Mar 2026 16:08:20 -0700 Subject: [PATCH] docs: add warning about localhost in trusted origins (#8527) --- docs/content/docs/reference/security.mdx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/content/docs/reference/security.mdx b/docs/content/docs/reference/security.mdx index f0901d6352..58444f979a 100644 --- a/docs/content/docs/reference/security.mdx +++ b/docs/content/docs/reference/security.mdx @@ -200,7 +200,7 @@ Trusted origins prevent CSRF attacks and block open redirects. You can set a lis ### Basic Usage -The most basic usage is to specify exact origins: +The most basic usage is to specify exact origins, below is an example of a trusted origins configuration: ```typescript { @@ -211,6 +211,9 @@ The most basic usage is to specify exact origins: ] } ``` + + Do not leave the localhost origin in a trusted origins list of a production auth instance. + ### Wildcard Origins