Patched code sample

import os
from flask import Flask, request
from werkzeug.middleware.proxy_fix import ProxyFix
from flask.sessions import SecureCookieSessionInterface

# In a real application, this would be the main Flask app object.
app = Flask(__name__)
app.secret_key = os.urandom(24)

# This custom session interface fixes the race condition by determining the
# 'secure' flag on a per-request basis, rather than reading a mutable
# global configuration value.
class ThreadSafeSessionInterface(SecureCookieSessionInterface):
    """
    A session interface that sets the 'Secure' attribute on session cookies
    based on the security of the incoming request, which is made reliable by
    the ProxyFix middleware. This prevents a race condition.
    """
    def get_cookie_secure(self, app):
        """
        Overrides the default behavior to use a thread-local, per-request
        value instead of a global configuration variable.
        """
        # request.is_secure is a thread-safe boolean that is correctly
        # set by the ProxyFix middleware based on trusted headers.
        return request.is_secure

# 1. The vulnerable `before_request` handler that modified app.config on every
#    request is removed entirely.

# 2. A middleware is configured to securely process proxy headers.
#    It trusts the X-Forwarded-Proto header from one trusted proxy (x_proto=1).
#    This makes `request.is_secure` a reliable indicator of whether the
#    original connection was made over HTTPS. An attacker spoofing the
#    header from an untrusted IP is ignored.
app.wsgi_app = ProxyFix(app.wsgi_app, x_proto=1)

# 3. Flask's default session handler is replaced with our thread-safe version.
#    This ensures the 'Secure' flag for the session cookie is set correctly
#    for each response without mutating shared global state.
app.session_interface = ThreadSafeSessionInterface()

# Example route to demonstrate session usage
@app.route("/")
def index():
    return "Session cookie 'Secure' flag will be set correctly."