Override aiohttp_session logger and improve session max_age

logviewer/core/auth.py

@@ -2,7 +2,7 @@
 from urllib.parse import urlencode
 
 import aiohttp
-from aiohttp_session import get_session, new_session
+from aiohttp_session import get_session, log as aiohttp_session_logger
 from core.models import getLogger
 
 logger = getLogger(__name__)
@@ -16,6 +16,11 @@
 TOKEN_URL = f"{API_BASE}/oauth2/token"
 ROLE_URL = f"{API_BASE}/guilds/{{guild_id}}/members/{{user_id}}"
 
+for handler in aiohttp_session_logger.log.handlers[:]:
+    aiohttp_session_logger.log.removeHandler(handler)
+
+aiohttp_session_logger.log.addHandler(logger)
+
 
 def authentication(func):
     async def wrapper(self, request, key=None, **kwargs):
@@ -105,7 +110,7 @@ async def login(request):
 
 
 async def oauth_callback(request):
-    session = await new_session(request)
+    session = await get_session(request)
 
     code = request.query.get("code")
     token = await fetch_token(code)

logviewer/core/servers.py

@@ -106,9 +106,15 @@ def init_hook(self) -> None:
         key = os.getenv("LOGVIEWER_SECRET", "A sophisticated key")[:24]
         key_b = key.encode("utf-8")
         key64 = base64.urlsafe_b64encode(key_b.ljust(32)[:32])
-        f = fernet.Fernet(key64)
-
-        setup(self.app, EncryptedCookieStorage(f))
+        secret_key = fernet.Fernet(key64)
+
+        # max_age = 3 days
+        setup(
+            self.app,
+            EncryptedCookieStorage(
+                secret_key, cookie_name="Logviewer session", max_age=86400, secure=True, samesite=True
+            ),
+        )
 
     def _add_routes(self) -> None:
         prefix = self.config.log_prefix or "/logs"