Enable the secure flag by default for the session cookie

code4romania · Jan 16, 2025 · 99e14cf · 99e14cf
1 parent 3869688
commit 99e14cf
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/backend/redirectioneaza/settings/base.py b/backend/redirectioneaza/settings/base.py
@@ -33,6 +33,8 @@
 CSRF_HEADER_NAME = "HTTP_X_XSRF_TOKEN"
 CSRF_COOKIE_NAME = "XSRF-TOKEN"
 
+SESSION_COOKIE_SECURE = env.bool("SESSION_COOKIE_SECURE")
+
 CORS_ALLOWED_ORIGINS = env.list("CORS_ALLOWED_ORIGINS")
 CORS_ALLOW_ALL_ORIGINS = env.bool("CORS_ALLOW_ALL_ORIGINS")
 

diff --git a/backend/redirectioneaza/settings/environment.py b/backend/redirectioneaza/settings/environment.py
@@ -12,6 +12,7 @@
     ENVIRONMENT=(str, "production"),
     DATA_UPLOAD_MAX_NUMBER_FIELDS=(int, 1000),
     OLD_SESSION_KEY=(str, ""),
+    SESSION_COOKIE_SECURE=(bool, True),
     LOG_LEVEL=(str, "WARNING"),
     ENABLE_CACHE=(bool, True),
     ENABLE_FORMS_DOWNLOAD=(bool, True),