enh: set up cookies more strictly

CHANGELOG

@@ -1,5 +1,6 @@
 0.9.6
  - enh: always encrypt beaker session cookies
+ - enh: set up cookies more strictly
  - ref: migrate to dcor_shared 0.6.0
  - setup: pin uwsgi==2.0.21 due to non-working harakiri
 0.9.5

dcor_control/resources/dcor_options.ini

@@ -73,13 +73,22 @@ ckanext.dcor_schemas.json_resource_schema_dir = package
 ckan.csrf_protection.ignore_extensions = false
 
 
-# cookies
-beaker.session.type = cookie
+# general ckan session cookies
+# 90 days validity
+beaker.session.cookie_expires = 7776000
+beaker.session.crypto_type = cryptography
 # Optimal would be "json", but there were issues with `datetime`
 # objects that could not be jsonified.
 beaker.session.data_serializer = pickle
 beaker.session.httponly = true
-beaker.session.secure = true
 beaker.session.samesite = Strict
-beaker.session.httponly = true
-beaker.session.crypto_type = cryptography
+beaker.session.secure = true
+beaker.session.type = cookie
+
+# flask login session cookies
+REMEMBER_COOKIE_NAME = remember_token
+# 90 days validity
+REMEMBER_COOKIE_DURATION = 7776000
+REMEMBER_COOKIE_SECURE = true
+REMEMBER_COOKIE_HTTPONLY = true
+REMEMBER_COOKIE_SAMESITE = Strict

dcor_control/resources/server_options.json

@@ -85,9 +85,11 @@
 "includes": {
     "general": {
      "ckan.ini": {
-        "sqlalchemy.url": "postgresql://ckan_default:<TEMPLATE:PGSQLPASS>@localhost/ckan_default",
+        "beaker.session.domain": "<TEMPLATE:HOSTNAME>",
+        "ckan.storage_path": "/data/ckan-<TEMPLATE:HOSTNAME>",
         "ckanext.dcor_depot.users_depot_name": "users-<TEMPLATE:HOSTNAME>",
-        "ckan.storage_path": "/data/ckan-<TEMPLATE:HOSTNAME>"
+        "REMEMBER_COOKIE_DOMAIN": "<TEMPLATE:HOSTNAME>",
+        "sqlalchemy.url": "postgresql://ckan_default:<TEMPLATE:PGSQLPASS>@localhost/ckan_default"
      }
     },
     "garching": {