Fixed remember login function

advanced_security_middleware.py

@@ -176,10 +176,11 @@ class SecurityManager:
             if not stored_token or not hmac.compare_digest(session_token, stored_token['token']):
                 return False
             
-            # Check session timeout
-            if time.time() - stored_token['created'] > self.session_timeout:
-                del self.session_tokens[user_id]
-                return False
+            # Check session timeout - skip if "Remember Me" is enabled
+            if not session.get('remember_me', False):
+                if time.time() - stored_token['created'] > self.session_timeout:
+                    del self.session_tokens[user_id]
+                    return False
             
             # Check if session IP matches (optional security measure)
             if self.app.config.get('STRICT_SESSION_IP', False):
@@ -425,17 +426,18 @@ def enhanced_login_required(f):
             session.clear()
             return jsonify({'error': 'Session security validation failed'}), 401
         
-        # Check session timeout
-        login_time_str = session.get('login_time')
-        if login_time_str:
-            try:
-                login_time = datetime.fromisoformat(login_time_str)
-                if datetime.utcnow() - login_time > timedelta(hours=8):
+        # Check session timeout - skip if "Remember Me" is enabled
+        if not session.get('remember_me', False):
+            login_time_str = session.get('login_time')
+            if login_time_str:
+                try:
+                    login_time = datetime.fromisoformat(login_time_str)
+                    if datetime.utcnow() - login_time > timedelta(hours=8):
+                        session.clear()
+                        return jsonify({'error': 'Session expired'}), 401
+                except ValueError:
                     session.clear()
-                    return jsonify({'error': 'Session expired'}), 401
-            except ValueError:
-                session.clear()
-                return jsonify({'error': 'Invalid session data'}), 401
+                    return jsonify({'error': 'Invalid session data'}), 401
         
         return f(*args, **kwargs)
     return decorated_function

app.py

@@ -32,8 +32,12 @@ app.config['SECRET_KEY'] = os.environ.get('SECRET_KEY')
 app.config['SQLALCHEMY_DATABASE_URI'] = os.environ.get('DATABASE_URL')
 app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = os.environ.get('SQLALCHEMY_TRACK_MODIFICATIONS')
 app.config['TEMPLATES_AUTO_RELOAD'] = os.environ.get('TEMPLATES_AUTO_RELOAD')
+
 # Session configuration for "Remember Me" functionality
 app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(days=30)
+app.config['SESSION_COOKIE_SECURE'] = False  # Set to True if using HTTPS
+app.config['SESSION_COOKIE_HTTPONLY'] = True
+app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
 
 # Initialize database
 db = SQLAlchemy(app)
@@ -1537,8 +1541,10 @@ def login():
                 # Set session as permanent if "Remember Me" is checked
                 if remember_me:
                     session.permanent = True
+                    session['remember_me'] = True
                 else:
                     session.permanent = False
+                    session['remember_me'] = False
                 
                 # Successful login
                 session['user_id'] = user.id