use SESSION_COOKIE_SECURE

compendium_v2/__init__.py

@@ -39,6 +39,7 @@ def _create_app(app_config) -> Flask:
 
     app.config['CONFIG_PARAMS'] = app_config
     app.config['SECRET_KEY'] = app_config['SECRET_KEY']
+    app.config['SESSION_COOKIE_SECURE'] = True
     if 'oidc' not in app_config:
         app.config['LOGIN_DISABLED'] = True
         logger.info('No OIDC configuration found, authentication disabled')