From fc40907a5866310f620d22c7f76ba5c148fafc07 Mon Sep 17 00:00:00 2001
From: Jacek Kowalski <Jacek@jacekk.info>
Date: Tue, 03 Nov 2026 21:04:42 +0000
Subject: [PATCH] Return CAS error instead of HTTP 500 on malformed tickets

---
 README.md |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/README.md b/README.md
index 3c48f4b..e0f0c1c 100644
--- a/README.md
+++ b/README.md
@@ -54,6 +54,9 @@
 In such case append `/login` to the CAS URL to get the "login URL".
 Similarly append `/serviceValidate` to get the "validate URL".
 
+Proxy callback URLs (`pgtUrl`) must match the client's redirect URIs and use HTTPS.
+Plain HTTP is accepted only if the realm's "Require SSL" setting allows it.
+
 ## Disclaimer
 
 This plugin was implemented from scratch to comply to the official CAS protocol specification,

--
Gitblit v1.10.0