Use server-side session storage

Avoids storing large cookies/tokens on client-side.

pyproject.toml

@@ -43,6 +43,7 @@ Flask-Pydantic = "^0.11.0"
 email-validator = "^1.3.0"
 python-ldap = "^3.4.3"
 Flask-pyoidc = "^3.11.0"
+Flask-Session = "^0.4.0"
 
 [tool.poetry.extras]
 test = [

resultsdb/__init__.py

@@ -32,6 +32,7 @@
     ProviderMetadata,
 )
 from flask_pyoidc.user_session import UserSession
+from flask_session import Session
 
 from resultsdb.proxy import ReverseProxied
 from resultsdb.controllers.main import main
@@ -103,6 +104,9 @@ def create_app(config_obj=None):
 
     db.init_app(app)
 
+    app.config["SESSION_SQLALCHEMY"] = db
+    app.server_session = Session(app)
+
     register_handlers(app)
 
     if app.config["AUTH_MODULE"] == "oidc":

resultsdb/config.py

@@ -89,6 +89,12 @@ class Config(object):
     OIDC_SESSION_PERMANENT = False
     PERMANENT_SESSION_LIFETIME = 300
 
+    SESSION_TYPE = "sqlalchemy"
+    SESSION_PERMANENT = True
+    SESSION_USE_SIGNER = True
+    SESSION_COOKIE_SECURE = True
+    SESSION_COOKIE_SAMESITE = "Lax"
+
     FEDMENU_URL = "https://apps.fedoraproject.org/fedmenu"
     FEDMENU_DATA_URL = "https://apps.fedoraproject.org/js/data.js"
 

testing/functest_api_v20.py

@@ -22,6 +22,7 @@
 import os
 import copy
 from unittest import TestCase
+from unittest.mock import patch
 
 from flask import current_app as app
 
@@ -1178,8 +1179,9 @@ def test_healthcheck_success(self):
         assert data.get("message") == "Health check OK"
 
     def test_healthcheck_fail(self):
-        db.drop_all()
-        r = self.app.get("/api/v2.0/healthcheck")
+        with patch("resultsdb.controllers.api_v2.db") as db:
+            db.session.execute.side_effect = RuntimeError("Testing DB outage")
+            r = self.app.get("/api/v2.0/healthcheck")
         assert r.status_code == 503
 
         data = json.loads(r.data)