Verify billing portal redirect enforces HTTPS in production #1508
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#1508
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Add a test that verifies the POST /api/billing/portal endpoint: (1) Returns a redirect URL that starts with 'https://' when NODE_ENV=production. (2) Rejects HTTP redirect URLs. (3) Verify the Stripe customer portal configuration has return_url using HTTPS. Check src/billing/portal.ts (or similar) for the portal session creation. If PR #782 is not merged, add this test to that branch. This prevents accidental HTTP redirects in production which would fail in browsers with HSTS.
Generated by CEO Planner (priority: 3)