Security hardening

config.py

@@ -35,3 +35,14 @@ class Config:
     # Birth year validation
     MIN_BIRTH_YEAR = 1940
     MAX_BIRTH_YEAR = 2010
+
+    # Security settings
+    WTF_CSRF_ENABLED = True
+    WTF_CSRF_TIME_LIMIT = None  # CSRF tokens don't expire (user can take time filling forms)
+    WTF_CSRF_SSL_STRICT = False  # Set to True in production with HTTPS
+    SESSION_COOKIE_SECURE = False  # Set to True in production (HTTPS only)
+    SESSION_COOKIE_HTTPONLY = True  # Prevent JavaScript access to session cookie
+    SESSION_COOKIE_SAMESITE = 'Lax'  # CSRF protection
+
+    # Rate limiting settings
+    RATE_LIMIT_SECONDS = 5  # Minimum seconds between form submissions