Set secure and httponly on formplayer_session cookie

[nospame]

Technical Summary

SAAS-15897
The secure flag was found not to be set on the formplayer_session cookie - this was traced to an issue of middleware order and layering (see Django docs). Since the SecureCookiesMiddleware modifies cookies the response object, it should be listed above middleware that adds cookies. This is because middleware is processed as a stack, top -> bottom for the request, then bottom -> top for the response.

Here I've moved the SecureCookiesMiddleware above every middleware that seems to add cookies, though that may not be strictly necessary since SelectiveSessionMiddleware and CsrfViewMiddleware also set secure based on their own settings.

I've also set the httponly flag on the formplayer_session cookie as recommended in the ticket.

Safety Assurance

Safety story

Tested locally and on staging to see that secure is now set on the formplayer_session cookie according to SecureCookiesMiddleware, and additionally that it now affects the sessionid and csrftoken cookies.

Also confirmed that httponly is now set for the formplayer_session cookie, which is appropriate here because we don't ever access it in javascript.

Automated test coverage

There are existing automated tests for SecureCookiesMiddleware though I haven't actually changed anything in that class.

QA Plan

Not planning QA.

Rollback instructions

• This PR can be reverted after deploy with no further considerations

Labels & Review

• Risk label is set correctly
• The set of people pinged as reviewers is appropriate for the level of risk of the change

[gherceg]

Thanks for fixing my past self's mistake 😁 good stuff!

[gherceg]

Not worth changing, but just curious what made you put this in a var rather than reference settings.SESSION_COOKIE_HTTPONLY directly?

[nospame]

Do you think it'd be nicer to just reference it directly? For me it feels like it represents a different concept, that whether the Formplayer session cookie should be httponly can be inferred based on whether the Django session cookie is httponly, but doesn't have to be based on that. I also thought about just setting it to True or even using httponly=True directly in set_cookie() - I think in practice they're all the same.

[gherceg]

Just wanted to check that the reasoning was along those lines. I don't have great context here, but from an initial read of this setting it seems like isn't that different of a concept? This is a session cookie, and we are using the SESSION_COOKIE_HTTPONLY settings when setting the httponly flag? It doesn't help that we don't use this setting anywhere else, but it seems like we should probably be referencing this same setting in other places where we set session cookies right?

[nospame]

I think it depends whether we're taking "session cookie" to mean "a cookie tied to the session" or "Django's sessionid cookie". I'm fine with the former interpretation, since in practice we do want it do be the same. 1301079