Add security enhancements. See: https://blog.miguelgrinberg.com/post/cookie-security-for-flask-applications

config.py

@@ -6,6 +6,11 @@ import logging
 class Config:
     ''' ### Flask ### '''
     SECRET_KEY = os.environ.get('SECRET_KEY') or 'hard to guess string'
+    SESSION_COOKIE_SECURE = True
+
+    ''' ### Flask-Login ### '''
+    REMEMBER_COOKIE_HTTPONLY = True
+    REMEMBER_COOKIE_SECURE = True
 
     ''' ### Flask-Mail ### '''
     MAIL_SERVER = os.environ.get('MAIL_SERVER')