Make other flask session cookies secure

roles/anitya/backend/templates/anitya.cfg

@@ -24,3 +24,6 @@ CNUCNU_WEB_FEDORA_OPENID = 'https://id.fedoraproject.org'
 
 # This is required to fix login
 PREFERRED_URL_SCHEME='https'
+
+# Make browsers send session cookie only via HTTPS
+SESSION_COOKIE_SECURE = True

roles/anitya/backend/templates/anitya_admin.cfg

@@ -24,3 +24,6 @@ CNUCNU_WEB_FEDORA_OPENID = 'https://id.fedoraproject.org'
 
 # This is required to fix login
 PREFERRED_URL_SCHEME='https'
+
+# Make browsers send session cookie only via HTTPS
+SESSION_COOKIE_SECURE = True

roles/blockerbugs/templates/blockerbugs-settings.py.j2

@@ -21,3 +21,6 @@ STREAM_LOGGING = False
 
 # to fix login issue for folks who are part of many FAS groups
 PREFERRED_URL_SCHEME='https'
+
+# Make browsers send session cookie only via HTTPS
+SESSION_COOKIE_SECURE = True

roles/elections/templates/fedora-elections.cfg

@@ -31,6 +31,9 @@ FAS_CHECK_CERT = True
 # This is required to fix login
 PREFERRED_URL_SCHEME='https'
 
+# Make browsers send session cookie only via HTTPS
+SESSION_COOKIE_SECURE = True
+
 DOGPILE_CACHE = {
     'backend': 'dogpile.cache.memcached',
     'arguments': {

roles/fedocal/templates/fedocal.cfg

@@ -33,6 +33,9 @@ PATH_ALEMBIC_INI='/etc/fedocal/alembic.ini'
 # This is required to fix login
 PREFERRED_URL_SCHEME='https'
 
+# Make browsers send session cookie only via HTTPS
+SESSION_COOKIE_SECURE = True
+
 {% if env == 'staging' %}
 APP_URL = 'https://apps.stg.fedoraproject.org/calendar/'
 FAS_OPENID_ENDPOINT = 'https://id.stg.fedoraproject.org/'

roles/kerneltest/templates/kerneltest.cfg

@@ -32,6 +32,9 @@ MAX_CONTENT_LENGTH = 1024 * 10
 # This is required to fix login
 PREFERRED_URL_SCHEME='https'
 
+# Make browsers send session cookie only via HTTPS
+SESSION_COOKIE_SECURE = True
+
 {% if env == 'staging' %}
 FAS_OPENID_ENDPOINT = 'https://id.stg.fedoraproject.org/'
 {% endif %}

roles/nuancier/templates/nuancier.cfg

@@ -46,6 +46,9 @@ THUMB_SIZE = (256, 256)
 # This is required to fix login in stg
 PREFERRED_URL_SCHEME='https'
 
+# Make browsers send session cookie only via HTTPS
+SESSION_COOKIE_SECURE = True
+
 # dogpile.cache configuration to work with memcached
 NUANCIER_CACHE_BACKEND = 'dogpile.cache.memcached'
 NUANCIER_CACHE_KWARGS = {'arguments' : {

roles/tagger/templates/fedoratagger.cfg.j2

@@ -12,6 +12,9 @@ FAS_OPENID_ENDPOINT = 'http://id.fedoraproject.org'
 # This is required for openid to work in stg.  Might as well for prod too.
 PREFERRED_URL_SCHEME = 'https'
 
+# Make browsers send session cookie only via HTTPS
+SESSION_COOKIE_SECURE = True
+
 # Stuff for toscawidgets2
 RES_PREFIX = '/tagger/_res/'