From 8d2ff06daeffb2e81b3787791871ccf192f03088 Mon Sep 17 00:00:00 2001
From: "patrick.lloret@protonmail.com" <patrick.lloret@protonmail.com>
Date: Sun, 25 Oct 2026 18:11:14 +0100
Subject: [PATCH] fix(api): move session secret to config, remove userinfo from
 session cookie

---
 carbonserver/carbonserver/api/routers/authenticate.py | 3 ---
 carbonserver/carbonserver/config.py                   | 5 +++++
 carbonserver/main.py                                  | 6 +++++-
 deploy/.env.example                                   | 3 ++-
 deploy/deploy.py                                      | 1 +
 5 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/carbonserver/carbonserver/api/routers/authenticate.py b/carbonserver/carbonserver/api/routers/authenticate.py
index e6abe8481..98e17759c 100644
--- a/carbonserver/carbonserver/api/routers/authenticate.py
+++ b/carbonserver/carbonserver/api/routers/authenticate.py
@@ -69,9 +69,6 @@ async def get_login(
             sign_up_service.check_jwt_user(id_token)
         else:
             sign_up_service.check_jwt_user(token["id_token"], create=True)
-        user = token.get("userinfo")
-        if user:
-            request.session["user"] = dict(user)
 
         base_url = request.base_url
         if settings.frontend_url != "":
diff --git a/carbonserver/carbonserver/config.py b/carbonserver/carbonserver/config.py
index 30c6c6c21..f13431e63 100644
--- a/carbonserver/carbonserver/config.py
+++ b/carbonserver/carbonserver/config.py
@@ -42,6 +42,11 @@ class Settings(BaseSettings):
     )
     environment: str = Field("production")
     jwt_key: str = Field("", validation_alias=AliasChoices("JWT_KEY", "jwt_key"))
+    # Used by SessionMiddleware between login steps
+    session_secret_key: str = Field(
+        "session_secret_key",
+        validation_alias=AliasChoices("SESSION_SECRET_KEY", "session_secret_key"),
+    )
     api_port: int = Field(8080, validation_alias=AliasChoices("API_PORT", "api_port"))
     server_host: str = Field(
         "0.0.0.0", validation_alias=AliasChoices("SERVER_HOST", "server_host")
diff --git a/carbonserver/main.py b/carbonserver/main.py
index c1f5dcaa6..bcff864c3 100644
--- a/carbonserver/main.py
+++ b/carbonserver/main.py
@@ -54,7 +54,11 @@ def create_app() -> FastAPI:
     server.add_exception_handler(DBException, db_exception_handler)
     server.add_exception_handler(ValidationError, validation_exception_handler)
     server.add_exception_handler(Exception, generic_exception_handler)
-    server.add_middleware(SessionMiddleware, secret_key="some-random-string")
+    server.add_middleware(
+        SessionMiddleware,
+        secret_key=settings.session_secret_key,
+        https_only=settings.environment == "production",
+    )
 
     return server
 
diff --git a/deploy/.env.example b/deploy/.env.example
index 78f85e507..c1d6373ba 100644
--- a/deploy/.env.example
+++ b/deploy/.env.example
@@ -6,4 +6,5 @@ FIEF_CLIENT_ID=
 FIEF_CLIENT_SECRET=
 FIEF_URL=
 FRONTEND_URL=
-JWT_KEY=
\ No newline at end of file
+JWT_KEY=
+SESSION_SECRET_KEY=
\ No newline at end of file
diff --git a/deploy/deploy.py b/deploy/deploy.py
index 69a9a7cb4..26653fdfc 100755
--- a/deploy/deploy.py
+++ b/deploy/deploy.py
@@ -72,6 +72,7 @@ def _setup(settings: Settings):
         "FRONTEND_URL": f"http://{settings.hostname}",
         "FIEF_URL": f"http://{settings.fief_hostname}",
         "JWT_KEY": secrets.token_urlsafe(32),
+        "SESSION_SECRET_KEY": secrets.token_urlsafe(32),
     }
     if settings.run_fief:
         variables["FIEF_CLIENT_ID"] = secrets.token_urlsafe(32)