Reorder SecureCookiesMiddleware and add docstring

dimagi · Sep 20, 2024 · f189561 · f189561
1 parent 7d98a3c
commit f189561
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/corehq/middleware.py b/corehq/middleware.py
@@ -340,6 +340,10 @@ def get_view_func(view_fn, view_kwargs):
 
 
 class SecureCookiesMiddleware(MiddlewareMixin):
+    """Sets `secure` flag for cookies on the response object.
+    Must be come before middleware that adds cookies, because of order and layering.
+    https://docs.djangoproject.com/en/4.2/topics/http/middleware/#middleware-order-and-layering
+    """
 
     def process_response(self, request, response):
         if hasattr(response, 'cookies') and response.cookies:

diff --git a/settings.py b/settings.py
@@ -146,6 +146,7 @@
 
 MIDDLEWARE = [
     'corehq.middleware.NoCacheMiddleware',
+    'corehq.middleware.SecureCookiesMiddleware',
     'corehq.middleware.SelectiveSessionMiddleware',
     'django.middleware.locale.LocaleMiddleware',
     'django.middleware.common.CommonMiddleware',
@@ -171,8 +172,6 @@
     'no_exceptions.middleware.NoExceptionsMiddleware',
     'corehq.apps.locations.middleware.LocationAccessMiddleware',
     'corehq.apps.cloudcare.middleware.CloudcareMiddleware',
-    # middleware that adds cookies must come before SecureCookiesMiddleware
-    'corehq.middleware.SecureCookiesMiddleware',
     'field_audit.middleware.FieldAuditMiddleware',
 ]