nakidai
/
whoogle-search
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve cookie security when `HTTPS_ONLY` is set 

Adds the "Secure" flag and "__Secure-" prefix if the `HTTPS_ONLY`
environment variable is enabled.

Fixes #539
main
Ben Busby 2021-11-20 16:34:37 -07:00
parent a768c1b5aa
commit de28e06d8f
No known key found for this signature in database
GPG Key ID: 339B7B7EB5333D14
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
app/__init__.py
View File

@ -15,7 +15,7 @@ app = Flask(__name__, static_folder=os.path.dirname(
os.path.abspath(__file__)) + '/static') os.path.abspath(__file__)) + '/static')
# Load .env file if enabled # Load .env file if enabled
if os.getenv("WHOOGLE_DOTENV", ''): if os.getenv('WHOOGLE_DOTENV', ''):
dotenv_path = '../whoogle.env' dotenv_path = '../whoogle.env'
load_dotenv(os.path.join(os.path.dirname(os.path.abspath(__file__)), load_dotenv(os.path.join(os.path.dirname(os.path.abspath(__file__)),
dotenv_path)) dotenv_path))
@ -24,6 +24,11 @@ app.default_key = generate_user_key()
app.config['SECRET_KEY'] = os.urandom(32) app.config['SECRET_KEY'] = os.urandom(32)
app.config['SESSION_TYPE'] = 'filesystem' app.config['SESSION_TYPE'] = 'filesystem'
app.config['SESSION_COOKIE_SAMESITE'] = 'strict' app.config['SESSION_COOKIE_SAMESITE'] = 'strict'
if os.getenv('HTTPS_ONLY'):
app.config['SESSION_COOKIE_NAME'] = '__Secure-session'
app.config['SESSION_COOKIE_SECURE'] = True
app.config['VERSION_NUMBER'] = '0.6.0' app.config['VERSION_NUMBER'] = '0.6.0'
app.config['APP_ROOT'] = os.getenv( app.config['APP_ROOT'] = os.getenv(
'APP_ROOT', 'APP_ROOT',

3
app/routes.py
View File

@ -518,7 +518,8 @@ def run_app() -> None:
os.environ['WHOOGLE_PROXY_TYPE'] = args.proxytype os.environ['WHOOGLE_PROXY_TYPE'] = args.proxytype
os.environ['WHOOGLE_PROXY_LOC'] = args.proxyloc os.environ['WHOOGLE_PROXY_LOC'] = args.proxyloc
os.environ['HTTPS_ONLY'] = '1' if args.https_only else '' if args.https_only:
os.environ['HTTPS_ONLY'] = '1'
if args.debug: if args.debug:
app.run(host=args.host, port=args.port, debug=args.debug) app.run(host=args.host, port=args.port, debug=args.debug)