Merge pull request #1521 from OpenTechFund/fix/cookie-security

Set COOKIE_SECURE to true in env var to set session and CSRF cookies …

opentech/settings/base.py

@@ -599,6 +599,10 @@ if env.get('SECURE_BROWSER_XSS_FILTER', 'true').lower().strip() == 'true':
 if env.get('SECURE_CONTENT_TYPE_NOSNIFF', 'true').lower().strip() == 'true':
     SECURE_CONTENT_TYPE_NOSNIFF = True
 
+if env.get('COOKIE_SECURE', 'false').lower().strip() == 'true':
+    SESSION_COOKIE_SECURE = True
+    CSRF_COOKIE_SECURE = True
+
 
 # Referrer-policy header settings
 # https://django-referrer-policy.readthedocs.io/en/1.0/

opentech/settings/local.py.example

@@ -25,3 +25,7 @@ CACHES = {
 
 # Enable Wagtail Cache while developing
 # WAGTAIL_CACHE = True
+
+# If you have a problem with "CSRF cookie not set".
+# CSRF_COOKIE_SAMESITE = None
+# SESSION_COOKIE_SAMESITE = None