fix: secure sessions behind HTTPS proxies

.env.example

@@ -7,6 +7,7 @@ ADMIN_EMAIL=admin@localhost
 ADMIN_PASSWORD=
 RETENTION_DAYS=30
 SESSION_MAX_AGE_SECONDS=28800
+SESSION_HTTPS_ONLY=false
 HUGGINGFACEHUB_API_TOKEN=
 HF_CHAT_MODEL=Qwen/Qwen2.5-7B-Instruct
 INFERENCE_PROVIDER=fallback

README.md

@@ -194,6 +194,7 @@ ADMIN_EMAIL=reviewer@example.com
 ADMIN_PASSWORD=<strong-secret-manager-value>
 RETENTION_DAYS=30
 SESSION_MAX_AGE_SECONDS=28800
+SESSION_HTTPS_ONLY=true
 ```
 
 Production behavior includes authenticated, owner-scoped analyses; signed HTTP-only session cookies; CSRF validation; explicit upload consent; automatic retention expiry; redacted audit events; protected history, details, reports, and review APIs; analysis rate/concurrency limits; CSP and HSTS headers; separate liveness/readiness endpoints; and a non-root container health check.

data/benchmark_runs/latest.json

@@ -6,7 +6,7 @@
     "provenance": "Repository-authored synthetic OCR text for regression testing; not clinician-adjudicated.",
     "created_at": "2026-07-11"
   },
-  "generated_at": "2026-07-12T04:19:11.682606+00:00",
+  "generated_at": "2026-07-12T04:36:50.992895+00:00",
   "case_count": 8,
   "success_count": 8,
   "failure_count": 0,

simpliscribe/config.py

@@ -24,6 +24,7 @@ class Settings:
     auth_required: bool = os.environ.get("AUTH_REQUIRED", "").strip().lower() in {"1", "true", "yes", "on"}
     retention_days: int = int(os.environ.get("RETENTION_DAYS", "30"))
     session_max_age_seconds: int = int(os.environ.get("SESSION_MAX_AGE_SECONDS", "28800"))
+    session_https_only: bool = os.environ.get("SESSION_HTTPS_ONLY", "").strip().lower() in {"1", "true", "yes", "on"}
     india_medicine_dataset: Path = BASE_DIR / "A_Z_medicines_dataset_of_India.csv"
     medicine_database_dataset: Path = BASE_DIR / "all_medicine databased.csv"
     max_upload_mb: int = int(os.environ.get("MAX_UPLOAD_MB", "10"))
@@ -56,6 +57,10 @@ class Settings:
     def authentication_enabled(self) -> bool:
         return self.production or self.auth_required
 
+    @property
+    def secure_transport(self) -> bool:
+        return self.production or self.session_https_only
+
     def validate_runtime(self) -> None:
         errors: list[str] = []
         if self.production:

simpliscribe/main.py

@@ -40,7 +40,7 @@ async def protect_health_data_responses(request: Request, call_next):
         response.headers.setdefault("X-Frame-Options", "DENY")
         response.headers.setdefault("Permissions-Policy", "camera=(), microphone=(), geolocation=()")
         response.headers.setdefault("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self'")
-        if settings.production:
+        if settings.secure_transport:
             response.headers.setdefault("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
     return response
 
@@ -52,7 +52,7 @@ app.add_middleware(
     secret_key=settings.session_secret,
     max_age=settings.session_max_age_seconds,
     same_site="lax",
-    https_only=settings.production,
+    https_only=settings.secure_transport,
 )