05/22 Enhance codes and fix bugs

2026-05-22 11:53:41 -04:00
parent d6d9b5e9dc
commit 3511ac2b56
13 changed files with 891 additions and 47 deletions
@@ -82,6 +82,10 @@ class DevelopmentConfig(Config):

 class ProductionConfig(Config):
    DEBUG = False
+    # Session cookie hardening — enforce HTTPS-only, no JS access, strict same-site.
+    SESSION_COOKIE_SECURE   = True   # only sent over HTTPS
+    SESSION_COOKIE_HTTPONLY = True   # not accessible via document.cookie
+    SESSION_COOKIE_SAMESITE = 'Lax'  # blocks cross-site POST forgery; 'Strict' would break OAuth flows


 config = {