Make session cookies more secure.

1. Our session cookies only need to be available to http, so
   mark them appropiately.

2. Send the cookie to the subpath for mediagoblin.

And instantiate a session manager on the app, once.

1 files changed, 6 insertions, 2 deletions

diff --git a/mediagoblin/app.py b/mediagoblin/app.py
index 2c772fe1..1137c0d7 100644
--- a/mediagoblin/app.py
+++ b/mediagoblin/app.py
@@ -73,6 +73,9 @@ class MediaGoblinApp(object):
         # Setup other connections / useful objects
         ##########################################
 
+        # Setup Session Manager, not needed in celery
+        self.session_manager = session.SessionManager()
+
         # load all available locales
         setup_locales()
 
@@ -157,7 +160,7 @@ class MediaGoblinApp(object):
 
         ## Attach utilities to the request object
         # Do we really want to load this via middleware?  Maybe?
-        session_manager = session.SessionManager()
+        session_manager = self.session_manager
         request.session = session_manager.load_session_from_cookie(request)
         # Attach self as request.app
         # Also attach a few utilities from request.app for convenience?
@@ -227,7 +230,8 @@ class MediaGoblinApp(object):
             response = render_http_exeption(
                 request, e, e.get_description(environ))
 
-        session_manager.save_session_to_cookie(request.session, response)
+        session_manager.save_session_to_cookie(request.session,
+                                               request, response)
 
         return response(environ, start_response)