Flask Session -> Double Token

backend/app.py

@@ -22,8 +22,7 @@ def create_app(db_path: str = "data.db") -> Flask:
         template_folder="../frontend/templates",
         static_folder="../frontend/static",
     )
-    # Generate a secure random key at startup.
-    # Set FLASK_SECRET_KEY env var for a fixed key (sessions survive restarts).
+    # Generate a secure random key at startup (kept for compatibility).
     app.config["SECRET_KEY"] = os.environ.get("FLASK_SECRET_KEY") or secrets.token_hex(32)
     # Defensive check: ensure key is never empty
     if not app.config["SECRET_KEY"]:
@@ -32,12 +31,8 @@ def create_app(db_path: str = "data.db") -> Flask:
     # Trust Nginx X-Forwarded-* headers (x_for=1, x_proto=1, x_host=1)
     app.wsgi_app = ProxyFix(app.wsgi_app, x_for=1, x_proto=1, x_host=1)
 
-    # Session hardening for production
-    https = os.environ.get("FLASK_HTTPS", "").lower() in ("1", "true", "yes")
-    app.config["SESSION_COOKIE_HTTPONLY"] = True
-    app.config["SESSION_COOKIE_SAMESITE"] = "Lax"
-    app.config["SESSION_COOKIE_SECURE"] = https
-    app.config["SESSION_PERMANENT"] = False
+    # Dual-token auth: access token in Authorization header, refresh token in
+    # an httpOnly cookie. No Flask session cookies are used anymore.
 
     # Strict CORS: only allow same-origin requests (no wildcard for cookie auth)
     CORS(app, supports_credentials=True, origins=[])  # empty = same-origin only
@@ -45,9 +40,6 @@ def create_app(db_path: str = "data.db") -> Flask:
     # Content size limit: 5MB for uploads
     app.config["MAX_CONTENT_LENGTH"] = 5 * 1024 * 1024
 
-    # Session lifetime: 24 hours idle timeout
-    app.config["PERMANENT_SESSION_LIFETIME"] = 86400
-
     # Global event bus
     app.event_bus = EventBus()