From cc30d241447a05a15a3c946d1ffd17c23979330d Mon Sep 17 00:00:00 2001 From: Alex Date: Sun, 16 Nov 2025 18:33:44 +0000 Subject: [PATCH] HTTPS cookie handling (#315) This is the one conflict from the other merge :) --- app.py | 13 ++++++------- env.py | 2 +- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/app.py b/app.py index f154a1c..1600e01 100644 --- a/app.py +++ b/app.py @@ -153,17 +153,16 @@ werkzeug_logger.addFilter(StatusEndpointFilter()) # The secret key will reset every time we restart, which will # require users to authenticate again -# Auto-detect HTTPS for secure cookies +# Secure cookie handling (HTTP vs HTTPS) # Can be overridden with SESSION_COOKIE_SECURE environment variable session_cookie_secure_env = os.getenv('SESSION_COOKIE_SECURE', 'auto').lower() -if session_cookie_secure_env == 'auto': - # Auto-detect: check if we're behind a reverse proxy with HTTPS - # This will be determined per-request, but default to False for local HTTP - SESSION_COOKIE_SECURE = False -elif session_cookie_secure_env in ['true', 'yes', '1']: +if session_cookie_secure_env in ['true', 'yes', '1']: SESSION_COOKIE_SECURE = True -else: +elif session_cookie_secure_env in ['false', 'no', '0']: SESSION_COOKIE_SECURE = False +else: + # Auto mode: align with deployment environment + SESSION_COOKIE_SECURE = APP_ENV == 'prod' app.config.update( SECRET_KEY = os.urandom(64), diff --git a/env.py b/env.py index c67d167..a7d60a3 100644 --- a/env.py +++ b/env.py @@ -6,7 +6,7 @@ def string_to_bool(s: str) -> bool: # Authentication and session settings # SESSION_COOKIE_SECURE: Controls whether session cookies are marked as secure (HTTPS only) -# - 'auto' (default): Uses False for local development, can be overridden +# - 'auto' (default): Uses False in dev, True in prod, can be overridden with environment variable # - 'true'/'yes'/'1': Always use secure cookies (recommended for production with HTTPS) # - 'false'/'no'/'0': Never use secure cookies (only for local HTTP) SESSION_COOKIE_SECURE_ENV = os.getenv("SESSION_COOKIE_SECURE", "auto")