Session cookie is never marked Secure #495

Tier 1: security

Problem

framework/hosting/simple_module_hosting/_phase_helpers.py:168:

app.add_middleware(SessionMiddleware, secret_key=settings.secret_key)

Neither this call nor simple_module_hosting/session.py passes https_only, so the session cookie has no Secure attribute. In production it can travel over plain HTTP, for example on the first request before HSTS is cached, or behind a misconfigured proxy.

This matters more here than usual because CSRF defence relies on SameSite=Lax alone. The opt-in token (simple_module_hosting.csrf) is used in only two places.

Fix

• https_only=not settings.is_development, or a HostSettings.session_cookie_secure field that defaults on outside development.
• Add a test asserting Secure appears in Set-Cookie when not in development.
• Mention it in the deployment docs, since installs that serve plain HTTP on purpose behind a TLS terminator need SM_TRUSTED_PROXY set.