remove same site

competitions/oauth.py

@@ -32,7 +32,11 @@ def attach_oauth(app: fastapi.FastAPI):
     session_secret = (OAUTH_CLIENT_SECRET or "") + "-v4"
     # ^ if we change the session cookie format in the future, we can bump the version of the session secret to make
     #   sure cookies are invalidated. Otherwise some users with an old cookie format might get a HTTP 500 error.
-    app.add_middleware(SessionMiddleware, secret_key=hashlib.sha256(session_secret.encode()).hexdigest())
+    app.add_middleware(
+        SessionMiddleware,
+        secret_key=hashlib.sha256(session_secret.encode()).hexdigest(),
+        https_only=True,
+    )
 
 
 def _add_oauth_routes(app: fastapi.FastAPI) -> None: