CKAN session cookie is not marked Secure

[adborden]

who.secure = True in production.ini for Inventory and Catalog, but I'm seeing the cookies not marked as Secure within the browser.

How to reproduce

1. Login to https://inventory.data.gov/user/login
2. Open developer tools (Application tab in Chrome) to view the cookies.

Expected behavior

Session cookie is marked Secure.

Actual behavior

Session cookie is not marked Secure.

[adborden]

I wonder if this is related to apache2 listening on HTTP instead of HTTPS.

[FuhuXia]

It is resolved on CKAN 2.9 while the cookie auth_tkt is set secure, the non relevant cookie ckan is left unsecure. Details in the slack discussion.

But after ckan 2.10, cookie auth_tkt is decommissioned, ckan is the only cookie now. We need to secure it.

[jbrown-xentity]

I believe catalog will only affect us if login problems persist, so I think that is the safest test. Then we can merge inventory

[jbrown-xentity]

Inventory and Catalog are both updated, and the cookie is marked as secure. This should be able to be marked as complete.

[Bagesary]

Fuhu will do a review and then bags can close

[FuhuXia]

Verified ckan cookie is secure after the fix.