Set samesite and secure attributes of session cookie. Enable strong session protection.

app/extensions.py

@@ -5,4 +5,5 @@ from flask_sqlalchemy import SQLAlchemy
 
 db = SQLAlchemy()
 login_manager = LoginManager()
+login_manager.session_protection = "strong"
 migrate = Migrate(db=db)

server.py

@@ -83,6 +83,9 @@ def create_app() -> Flask:
 
     # to avoid conflict with other cookie
     app.config["SESSION_COOKIE_NAME"] = "slapp"
+    if URL.startswith("https"):
+        app.config["SESSION_COOKIE_SECURE"] = True
+    app.config["SESSION_COOKIE_SAMESITE"] = "strict"
 
     init_extensions(app)
     register_blueprints(app)