Fixed remember login function

advanced_security_middleware.py

@@ -176,7 +176,8 @@ class SecurityManager:
             if not stored_token or not hmac.compare_digest(session_token, stored_token['token']):
                 return False
             
-            # Check session timeout
+            # Check session timeout - skip if "Remember Me" is enabled
+            if not session.get('remember_me', False):
                 if time.time() - stored_token['created'] > self.session_timeout:
                     del self.session_tokens[user_id]
                     return False
@@ -425,7 +426,8 @@ def enhanced_login_required(f):
             session.clear()
             return jsonify({'error': 'Session security validation failed'}), 401
         
-        # Check session timeout
+        # Check session timeout - skip if "Remember Me" is enabled
+        if not session.get('remember_me', False):
             login_time_str = session.get('login_time')
             if login_time_str:
                 try:

app.py

@@ -32,8 +32,12 @@ app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY')
 app.config['SQLALCHEMY_DATABASE_URI'] = os.environ.get('DATABASE_URL')
 app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = os.environ.get('SQLALCHEMY_TRACK_MODIFICATIONS')
 app.config['TEMPLATES_AUTO_RELOAD'] = os.environ.get('TEMPLATES_AUTO_RELOAD')
+
 # Session configuration for "Remember Me" functionality
 app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=30)
+app.config['SESSION_COOKIE_SECURE'] = False  # Set to True if using HTTPS
+app.config['SESSION_COOKIE_HTTPONLY'] = True
+app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
 
 # Initialize database
 db = SQLAlchemy(app)
@@ -1537,8 +1541,10 @@ def login():
                 # Set session as permanent if "Remember Me" is checked
                 if remember_me:
                     session.permanent = True
+                    session['remember_me'] = True
                 else:
                     session.permanent = False
+                    session['remember_me'] = False
                 
                 # Successful login
                 session['user_id'] = user.id