From c88ebabc784ee6ea6b2db9ae30dd427c43ddfe73 Mon Sep 17 00:00:00 2001
From: Chris Hines <chris.hines@monash.edu>
Date: Fri, 9 Aug 2019 11:57:55 +0800
Subject: [PATCH] tighten the options around cookies for better security
---
TES/tes/__init__.py | 3 +++
1 file changed, 3 insertions(+)
diff --git a/TES/tes/__init__.py b/TES/tes/__init__.py
index 0e2459d..370fe8e 100644
--- a/TES/tes/__init__.py
+++ b/TES/tes/__init__.py
@@ -12,6 +12,9 @@ import datetime
app.config['PERMANENT_SESSION_LIFETIME'] = datetime.timedelta(seconds=3600)
app.config['SESSION_REFRESH_EACH_REQUEST'] = True
app.config['SESSION_COOKIE_NAME'] = 'tessession'
+app.config['SESSION_COOKIE_SECURE'] = True
+app.config['SESSION_COOKIE_HTTPONLY'] = True
+app.config['SESSION_COOKIE_SAMESITE'] = 'Strict'
app.config['APPLICATION_ROOT'] = '/'
if not app.config['LOCAL_DEV']:
app.config['APPLICATION_ROOT'] = '/tes'
--
GitLab