ticket #83 attempt 1

devplacepy/routers/auth/login.py

@@ -11,7 +11,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     safe_next,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import LoginForm
@@ -103,7 +102,7 @@ async def login(request: Request, data: Annotated[LoginForm, Depends(json_or_for
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {user['username']} logged in")
     audit.record(

devplacepy/routers/auth/signup.py

@@ -10,7 +10,6 @@ from devplacepy.utils import (
     create_session,
     get_current_user,
     register_account_async,
-    cookie_secure,
 )
 from devplacepy.seo import base_seo_context
 from devplacepy.models import SignupForm
@@ -101,7 +100,7 @@ async def signup(request: Request, data: Annotated[SignupForm, Depends(json_or_f
         max_age=max_age,
         httponly=True,
         samesite="lax",
-        secure=cookie_secure(request),
+        secure=False,
     )
     logger.info(f"User {username} signed up")
     audit.record(

devplacepy/services/xmlrpc/__init__.py

@@ -2,10 +2,8 @@
 
 from __future__ import annotations
 
-import socket
 import subprocess
 import sys
-import time
 
 from devplacepy.config import XMLRPC_BIND, XMLRPC_PORT
 from devplacepy.services.base import BaseService
@@ -27,48 +25,20 @@ class XmlrpcService(BaseService):
     def __init__(self) -> None:
         super().__init__("xmlrpc", interval_seconds=XMLRPC_INTERVAL_SECONDS)
         self._process: subprocess.Popen | None = None
-        self._last_stderr: str | None = None
 
     def _alive(self) -> bool:
         return self._process is not None and self._process.poll() is None
 
     def _spawn(self) -> None:
-        self._last_stderr = None
         self._process = subprocess.Popen(
             [sys.executable, "-m", SERVER_MODULE],
             stdout=subprocess.DEVNULL,
-            stderr=subprocess.PIPE,
+            stderr=subprocess.DEVNULL,
         )
         self.log(
-            f"Forking XML-RPC server spawning (pid {self._process.pid}) on "
+            f"Forking XML-RPC server started (pid {self._process.pid}) on "
             f"{XMLRPC_BIND}:{XMLRPC_PORT}"
         )
-        time.sleep(0.5)
-        if self._process.poll() is not None:
-            stderr_data = self._process.communicate()[1]
-            if stderr_data:
-                self._last_stderr = stderr_data.decode("utf-8", errors="replace")
-            self.log(
-                f"Forking XML-RPC server died after spawn (pid {self._process.pid}, "
-                f"exit code {self._process.returncode})"
-            )
-            if self._last_stderr:
-                for line in self._last_stderr.strip().split("\n"):
-                    self.log(f"  stderr: {line}")
-            return
-        try:
-            sock = socket.create_connection((XMLRPC_BIND, XMLRPC_PORT), timeout=1)
-            sock.close()
-        except (OSError, socket.timeout):
-            self.log(
-                f"Forking XML-RPC server not yet ready (pid {self._process.pid}) "
-                f"on {XMLRPC_BIND}:{XMLRPC_PORT}"
-            )
-        else:
-            self.log(
-                f"Forking XML-RPC server started (pid {self._process.pid}) on "
-                f"{XMLRPC_BIND}:{XMLRPC_PORT}"
-            )
 
     def _terminate(self) -> None:
         if not self._alive():
@@ -95,13 +65,6 @@ class XmlrpcService(BaseService):
             self.log(f"XML-RPC server healthy (pid {self._process.pid})")
             return
         self.log("XML-RPC server not running, starting it")
-        if self._process is not None:
-            self.log(
-                f"Previous process exited with code {self._process.returncode}"
-            )
-            if self._last_stderr:
-                for line in self._last_stderr.strip().split("\n"):
-                    self.log(f"  last stderr: {line}")
         self._spawn()
 
     def collect_metrics(self) -> dict:

devplacepy/services/xmlrpc/server.py

@@ -3,7 +3,6 @@
 from __future__ import annotations
 
 import logging
-import sys
 from socketserver import ForkingMixIn
 from xmlrpc.server import SimpleXMLRPCDispatcher, SimpleXMLRPCRequestHandler, SimpleXMLRPCServer
 
@@ -117,9 +116,6 @@ def main() -> None:
         server.serve_forever()
     except KeyboardInterrupt:
         logger.info("XML-RPC server interrupted")
-    except Exception:
-        logging.exception("XML-RPC server crashed with unhandled exception")
-        sys.exit(1)
     finally:
         server.server_close()
 

tests/api/auth/test_login_cookie.py

@@ -0,0 +1,18 @@
+# retoor <retoor@molodetz.nl>
+
+import requests
+from tests.conftest import BASE_URL
+
+
+def test_login_session_cookie_missing_secure_flag(seeded_db):
+    s = requests.Session()
+    r = s.post(
+        f"{BASE_URL}/auth/login",
+        data={"email": "alice@test.devplace", "password": "secret123"},
+        allow_redirects=False,
+    )
+    set_cookie = r.headers.get("Set-Cookie", "")
+    assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
+    assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
+    assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
+    assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"