From 0a951029fdfe2b89b9fcaad6a92527e49cd51756 Mon Sep 17 00:00:00 2001 From: Praxis CI Date: Tue, 4 Aug 2026 01:12:14 +0000 Subject: [PATCH] =?UTF-8?q?fix(P01):=20SessionMiddleware=20kwargs=20?= =?UTF-8?q?=E2=80=94=20https=5Fonly/same=5Fsite=20(not=20secure/samesite)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Starlette SessionMiddleware uses `https_only` (not `secure`), `same_site` (not `samesite`), and has no `httponly` kwarg (httponly is always true for session cookies). The previous kwargs raised TypeError at middleware stack build time. Cookie semantics are unchanged: https_only=secure flag, same_site=strict, max_age=28800 (8h), session_cookie=praxis_op. ---ci--- project: praxis phase: 1 milestone: v0.4 status: execute persona: security-engineer task: 03-02-fix requirements: covered: [REQ-AUTH-01, REQ-NFR-AUTH-01] ---/ci--- --- server/auth/cookies.py | 5 ++--- tests/test_auth.py | 9 +++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/server/auth/cookies.py b/server/auth/cookies.py index 3f12c79..156f570 100644 --- a/server/auth/cookies.py +++ b/server/auth/cookies.py @@ -59,9 +59,8 @@ def get_session_middleware_kwargs() -> dict: "secret_key": secret, "session_cookie": "praxis_op", "max_age": _COOKIE_MAX_AGE_S, - "httponly": True, - "samesite": "strict", - "secure": secure, + "https_only": secure, + "same_site": "strict", "path": "/", } diff --git a/tests/test_auth.py b/tests/test_auth.py index 3c5f6e3..56a1a4c 100644 --- a/tests/test_auth.py +++ b/tests/test_auth.py @@ -68,9 +68,10 @@ def test_cookie_kwargs_defaults(monkeypatch): kw = get_session_middleware_kwargs() assert kw["session_cookie"] == "praxis_op" assert kw["max_age"] == 28800 - assert kw["httponly"] is True - assert kw["samesite"] == "strict" - assert kw["secure"] is True + # Starlette SessionMiddleware: https_only (not secure), same_site (not samesite), + # httponly is always True (no kwarg). path is the cookie path. + assert kw["https_only"] is True + assert kw["same_site"] == "strict" assert kw["path"] == "/" @@ -78,7 +79,7 @@ def test_cookie_secure_false(monkeypatch): monkeypatch.setenv("PRAXIS_COOKIE_SECRET", "x" * 48) monkeypatch.setenv("PRAXIS_COOKIE_SECURE", "false") kw = get_session_middleware_kwargs() - assert kw["secure"] is False + assert kw["https_only"] is False def test_cookie_secret_unset_generates_random(monkeypatch):