Add explicit cookie config

[amplifi]

Proposed changes in this pull request

Sets explicit configuration for session length to address #1273. Also requires session cookie and CSRF token to be treated as secure by the browser.

Session length is two hours in seconds; alternative expiry suggestions?

When should this PR be merged

Should be thoroughly tested on desktop and mobile browsers before merging.

Risks

Session expiry too low could negatively impact UX, while too high poses a security risk. Needs to be evaluated in the context of our most common use cases.

Follow up actions

Implement idle timeout for sessions.

Checklist (for reviewing)

General

• Is this PR explained thoroughly? All code changes must be accounted for in the PR description.
• Is the PR labeled correctly? It should have the migration label if a new migration is added.
• Is the risk level assessment sufficient? The risks section should contain all risks that might be introduced with the PR and which actions we need to take to mitigate these risks. Possible risks are database migrations, new libraries that need to be installed or changes to deployment scripts.

Functionality

• Are all requirements met? Compare implemented functionality with the requirements specification.
• Does the UI work as expected? There should be no Javascript errors in the console; all resources should load. There should be no unexpected errors. Deliberately try to break the feature to find out if there are corner cases that are not handled.

Code

• Do you fully understand the introduced changes to the code? If not ask for clarification, it might uncover ways to solve a problem in a more elegant and efficient way.
• Does the PR introduce any inefficient database requests? Use the debug server to check for duplicate requests.
• Are all necessary strings marked for translation? All strings that are exposed to users via the UI must be marked for translation.

Tests

• Are there sufficient test cases? Ensure that all components are tested individually; models, forms, and serializers should be tested in isolation even if a test for a view covers these components.
• If this is a bug fix, are tests for the issue in place There must be a test case for the bug to ensure the issue won’t regress. Make sure that the tests break without the new code to fix the issue.
• If this is a new feature or a significant change to an existing feature has the manual testing spreadsheet been updated with instructions for manual testing?

Documentation

• Are changes to the UI documented in the platform docs? If this PR introduces new platform site functionality or changes existing ones, the changes must be documented in the Cadasta Platform Documentation.
• Are changes to the API documented in the API docs? If this PR introduces new API functionality or changes existing ones, the changes must be documented in the API docs.
• Are reusable components documented? If this PR introduces components that are relevant to other developers (for instance a mixin for a view or a generic form) they should be documented in the Wiki.

[khantaalaman]

@amplifi You mentioned (in concerned issue) that time duration for session timeout should not be greater than 24 hours. In your PR you are taking it to be around 5 days.
Just mentioning for double check :)

[amplifi]

@khantaalaman This PR sets the SESSION_COOKIE_AGE to 7200 seconds, which is the equivalent of two hours.

https://docs.djangoproject.com/en/1.10/ref/settings/#std:setting-SESSION_COOKIE_AGE

[khantaalaman]

@amplifi Sorry, my bad. Don't know why I thought its minutes.

[amplifi]

@khantaalaman No worries! I appreciate the second set of eyes.

[oliverroick]

The settings should only be added to the production settings. The dev VM doesn't do HTTPS, so you can't login locally to test things.

[amplifi]

@oliverroick Agreed; moved the config to prod and opening an issue to add SSL to the dev VM.