fix(security) : Insecure defaults allow session hijacking via cookie sniffing and IP spoofing

[prince-shakyaa]

Summary

Fixes two critical insecure defaults in the application's configuration and middleware, ensuring the platform is secure when deployed to production.

Fixes #498

---

Changes

1. Secure Session Cookies by Default

The default SESSION_COOKIE_SECURE has been changed from False to True in finbot/config.py.

• Session cookies will now only be transmitted over encrypted HTTPS connections by default, mitigating Man-in-the-Middle (MitM) cookie theft.
• Local Dev Note: For local development over http://localhost, developers can opt-out by setting SESSION_COOKIE_SECURE=false in their .env file. This override is now commented out by default in .env.example to ensure raw copy-pastes to production servers remain secure.

2. Opt-in IP Hijack Heuristics for PaaS Compatibility

The ProxyHeadersMiddleware previously trusted ["*"] globally. In an earlier iteration of this PR, it was restricted to 127.0.0.1, which caused operational failure and false-positive hijack alarms on PaaS platforms (like Railway or Fly) that use churning internal proxy IPs.

Following reviewer feedback, the architecture has been revised:

• Default (Unset): TRUSTED_PROXY_IPS defaults to unset. The app falls back to trusting ["*"] so PaaS deployments function correctly. The application emits a startup warning noting the degraded security state, and the SessionContext safely falls back to logging IP changes via a structured extra={"trusted_source": False} flag at the INFO level to maintain forensic queryability in downstream log shippers without triggering strict hijack alerts.
• Opt-in (Set): Operators who configure their edge proxy to strip inbound X-Forwarded-For headers can set TRUSTED_PROXY_IPS (e.g., 10.0.0.0/8) in their environment. This explicitly enables the strong, trusted IP-spoofing hijack heuristics.

3. Test Coverage Added

• tests/unit/core/test_proxy_middleware_startup.py: Mocks the uvicorn logger to verify the startup warning correctly fires when TRUSTED_PROXY_IPS is unset, and stays silent when configured.
• tests/unit/auth/test_session_ip_logging.py: A parameterised test asserting that the structured log flag correctly downgrades to app.trusted_source=False when proxy IPs are untrusted.
• tests/unit/core/test_proxy_middleware_behavior.py: Mathematically asserts uvicorn's right-to-left traversal logic, verifying that IP spoofing is successfully mitigated (and documenting the chained-header vulnerability that occurs if an edge proxy appends instead of strips).
• tests/unit/core/test_config_defaults.py: A hermetic isolation test (chdir(tmp_path) + environment wipe) that explicitly pins the SESSION_COOKIE_SECURE=True code-level fallback.

---

Testing locally

1. Try to sign in locally over HTTP (localhost) without .env configured. The session cookie will not be set on your browser (because Secure=True).
2. Add SESSION_COOKIE_SECURE=false to .env and restart. The session cookie is now set.
3. Check application startup logs: you will see the warning TRUSTED_PROXY_IPS is unset. Client IPs are untrusted and IP-based hijack detection is disabled.
4. Set TRUSTED_PROXY_IPS=127.0.0.1 in your .env and restart. The warning disappears, and strict IP verification is active.
5. Run the new tests: pytest tests/unit/core/test_proxy_middleware_startup.py tests/unit/auth/test_session_ip_logging.py

[prince-shakyaa]

Hii @saikishu @e2hln,
I've hardened our defaults by setting SESSION_COOKIE_SECURE=True and making TRUSTED_PROXY_IPS an opt-in env var for strict IP spoofing checks. To ensure PaaS compatibility (like Railway), the proxy falls back to ["*"] when unset while gracefully logging untrusted IP changes via app.trusted_source=False. I've also added comprehensive unit/integration tests to ensure this is completely bulletproof.
Let me know if you need any changes.
Thank You.