Session cookie security

app.py

@@ -29,7 +29,7 @@ from common import git_command

                                
                                
                                
                            
                                
                                    
                                        
                                            29  
                                            from flask_babel import Babel, gettext, ngettext, force_locale
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            30  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            31  
                                            _ = gettext
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        32 -
                                        n_ = gettext
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        32 +
                                        n_ = ngettext
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            33  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            34  
                                            app = flask.Flask(__name__)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            35  
                                            app.config.from_mapping(
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        

@@ -47,6 +47,10 @@ app.config["SECRET_KEY"] = config.DB_PASSWORD

                                
                                
                                
                            
                                
                                    
                                        
                                            47  
                                            app.config["SQLALCHEMY_TRACK_MODIFICATIONS"] = False
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            48  
                                            app.config["BABEL_TRANSLATION_DIRECTORIES"] = "i18n"
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            49  
                                            app.config["MAX_CONTENT_LENGTH"] = config.MAX_PAYLOAD_SIZE
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        50 +
                                        app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        51 +
                                        app.config["SESSION_COOKIE_SECURE"] = config.suggest_https       # only send cookies over HTTPS if the server is configured for it
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        52 +
                                        app.config["SESSION_COOKIE_HTTPONLY"] = True                     # don't allow JS to access the cookie
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        53 +
                                        app.config["SESSION_COOKIE_DOMAIN"] = config.BASE_DOMAIN         # don't share across subdomains, since user content is hosted there
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            54  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            55  
                                            db = SQLAlchemy(app)
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            56  
                                            bcrypt = Bcrypt(app)