feat: set flight.views.restrict_to_path and disable method override in bootstrap

SECURITY.md

@@ -60,6 +60,8 @@ When adding pages with third-party scripts, styles, or iframes, **update CSP del
 
 - Read input via **`$app->request()`** (query, data, cookies) — not `$_GET` / `$_POST` / `$_COOKIE` in app code.
 - **Twig auto-escapes** by default — do not use `|raw` / unescaped output unless the content is trusted and you understand the risk.
+- Bootstrap sets **`flight.views.restrict_to_path` to `true`** so Flight's native `View` cannot include templates outside `flight.views.path`. Twig's `FilesystemLoader` already roots at `app/views/`. Do not turn this off without a documented reason.
+- Bootstrap also sets **`flight.allow_method_override` to `false`**. Only re-enable it if you need HTML forms to spoof `PUT`/`DELETE` via `_method`.
 - For JSON APIs, do not reflect unsanitized input into HTML elsewhere without escaping.
 - Validate and authorize **server-side**; never trust client-only checks.
 

app/config/bootstrap.php

@@ -65,6 +65,11 @@
 $app->set('flight.views.path', __DIR__ . $ds . '..' . $ds . 'views');
 $app->set('flight.views.extension', '.twig');
 $app->set('flight.content_length', false);
+// Harden: do not allow X-HTTP-Method-Override / _method spoofing unless you need it
+$app->set('flight.allow_method_override', false);
+// Harden: keep native View templates inside flight.views.path (Twig has its own loader root).
+// Harmless on older core that ignores the key; applied when flightphp/core supports it.
+$app->set('flight.views.restrict_to_path', true);
 
 // CSP nonce per request (used by SecurityHeadersMiddleware + Twig globals)
 $nonce = bin2hex(random_bytes(16));

tests/Unit/BootstrapHardeningTest.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Guards the security switches we expect in bootstrap for new projects.
+ */
+class BootstrapHardeningTest extends TestCase
+{
+    public function testBootstrapEnablesViewPathRestrictionAndDisablesMethodOverride(): void
+    {
+        $bootstrap = file_get_contents(dirname(__DIR__, 2) . '/app/config/bootstrap.php');
+        $this->assertNotFalse($bootstrap);
+        $this->assertStringContainsString("set('flight.allow_method_override', false)", $bootstrap);
+        $this->assertStringContainsString("set('flight.views.restrict_to_path', true)", $bootstrap);
+    }
+}