05/02/2026 updated code for security 5

app/config.py

@@ -22,6 +22,19 @@ class BaseConfig:
     )
     SQLALCHEMY_TRACK_MODIFICATIONS = False
 
+    # MySQL closes idle connections after wait_timeout (default 8 hours).
+    # pool_recycle ensures SQLAlchemy replaces connections before that deadline.
+    # pool_pre_ping sends a cheap SELECT 1 before each checkout so stale
+    # connections are detected and recycled rather than causing "MySQL has gone
+    # away" errors on the first request after a long idle period.
+    SQLALCHEMY_ENGINE_OPTIONS = {
+        'pool_recycle': 3600,   # recycle connections after 1 hour
+        'pool_pre_ping': True,  # test each connection before use
+        'pool_timeout': 30,     # raise after 30 s if no connection available
+        'pool_size': 10,        # base pool size per worker
+        'max_overflow': 5,      # allow up to 5 extra connections under load
+    }
+
     WTF_CSRF_ENABLED = True
     WTF_CSRF_TIME_LIMIT = 3600
 
@@ -46,6 +59,12 @@ class BaseConfig:
     # Set via .env: STATIC_VERSION=20260418
     STATIC_VERSION = os.environ.get('STATIC_VERSION', '1')
 
+    # Session cookie defaults — applied in all environments.
+    # SECURE is intentionally left out of BaseConfig so dev HTTP still works.
+    # See ProductionConfig below for the full hardened set.
+    SESSION_COOKIE_HTTPONLY = True
+    SESSION_COOKIE_SAMESITE = 'Lax'
+
 
 class DevelopmentConfig(BaseConfig):
     DEBUG = True
@@ -55,7 +74,7 @@ class DevelopmentConfig(BaseConfig):
 class ProductionConfig(BaseConfig):
     DEBUG = False
     RATELIMIT_ENABLED = True
-    # Force HTTPS in production
+    # Force HTTPS in production — marks cookie Secure so it is never sent over HTTP.
     SESSION_COOKIE_SECURE = True
     SESSION_COOKIE_HTTPONLY = True
     SESSION_COOKIE_SAMESITE = 'Lax'