We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Secure critical Django cookies
The following can be configured in [`settings.py`](https://github.com/cal-itp/benefits/blob/dev/benefits/settings.py).

Setting these ensures the cookies expire and are deleted when the user's browser closes (makes them session cookies)

* [x] [`CSRF_COOKIE_AGE`](https://docs.djangoproject.com/en/3.2/ref/settings/#csrf-cookie-age) = None
* [x] ~[`SESSION_COOKIE_AGE`](https://docs.djangoproject.com/en/3.2/ref/settings/#session-cookie-age) = None~
* [x] [`SESSION_EXPIRE_AT_BROWSER_CLOSE `](https://docs.djangoproject.com/en/3.2/ref/settings/#session-cookie-age) = True

We also want to prevent the CSRF cookie from being sent in cross-browser requests. E.g. a user clicks on a link to our site, from another site - in this case we don't want any previous CSRF cookie already in their browser sent. It's unlikely to be an issue in our app since there are no user logins etc. but for consistency with our other cookies (session and language).

* [x] [`CSRF_COOKIE_SAMESITE`](https://docs.djangoproject.com/en/3.2/ref/settings/#csrf-cookie-samesite) = "Strict"

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `benefits/settings.py`
Content:
```
1 """
2 Django settings for benefits project.
3 """
4 import os
5 
6 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
7 BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
8 
9 # SECURITY WARNING: keep the secret key used in production secret!
10 SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
11 
12 # SECURITY WARNING: don't run with debug turned on in production!
13 DEBUG = os.environ.get("DJANGO_DEBUG", "False").lower() == "true"
14 
15 ADMIN = os.environ.get("DJANGO_ADMIN", "False").lower() == "true"
16 
17 ALLOWED_HOSTS = []
18 
19 if DEBUG:
20     ALLOWED_HOSTS.extend(["*"])
21 else:
22     hosts = os.environ["DJANGO_ALLOWED_HOSTS"].split(",")
23     ALLOWED_HOSTS.extend(hosts)
24 
25 # Application definition
26 
27 INSTALLED_APPS = [
28     "django.contrib.sessions",
29     "django.contrib.staticfiles",
30     "benefits.core",
31     "benefits.enrollment",
32     "benefits.eligibility",
33 ]
34 
35 if ADMIN:
36     INSTALLED_APPS.extend(
37         [
38             "django.contrib.admin",
39             "django.contrib.auth",
40             "django.contrib.contenttypes",
41             "django.contrib.messages",
42         ]
43     )
44 
45 MIDDLEWARE = [
46     "django.middleware.security.SecurityMiddleware",
47     "django.contrib.sessions.middleware.SessionMiddleware",
48     "django.middleware.locale.LocaleMiddleware",
49     "benefits.core.middleware.Healthcheck",
50     "django.middleware.common.CommonMiddleware",
51     "django.middleware.csrf.CsrfViewMiddleware",
52     "django.middleware.clickjacking.XFrameOptionsMiddleware",
53     "benefits.core.middleware.DebugSession",
54     "benefits.core.middleware.ChangedLanguageEvent",
55 ]
56 
57 if ADMIN:
58     MIDDLEWARE.extend(
59         [
60             "django.contrib.auth.middleware.AuthenticationMiddleware",
61             "django.contrib.messages.middleware.MessageMiddleware",
62         ]
63     )
64 
65 CSRF_COOKIE_HTTPONLY = True
66 
67 SESSION_COOKIE_AGE = 3600
68 SESSION_COOKIE_SAMESITE = "Strict"
69 SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies"
70 
71 if not DEBUG:
72     CSRF_COOKIE_SECURE = True
73     CSRF_FAILURE_VIEW = "benefits.core.views.csrf_failure"
74     SESSION_COOKIE_SECURE = True
75 
76 ROOT_URLCONF = "benefits.urls"
77 
78 template_ctx_processors = [
79     "django.template.context_processors.request",
80     "benefits.core.context_processors.analytics",
81 ]
82 
83 if DEBUG:
84     template_ctx_processors.extend(
85         [
86             "django.template.context_processors.debug",
87             "benefits.core.context_processors.debug",
88         ]
89     )
90 
91 if ADMIN:
92     template_ctx_processors.extend(
93         [
94             "django.contrib.auth.context_processors.auth",
95             "django.contrib.messages.context_processors.messages",
96         ]
97     )
98 
99 TEMPLATES = [
100     {
101         "BACKEND": "django.template.backends.django.DjangoTemplates",
102         "DIRS": [os.path.join(BASE_DIR, "benefits", "templates")],
103         "APP_DIRS": True,
104         "OPTIONS": {
105             "context_processors": template_ctx_processors,
106         },
107     },
108 ]
109 
110 WSGI_APPLICATION = "benefits.wsgi.application"
111 
112 DATABASES = {
113     "default": {
114         "ENGINE": "django.db.backends.sqlite3",
115         "NAME": os.environ.get("DJANGO_DB", "django") + ".db",
116     }
117 }
118 
119 # Password validation
120 
121 AUTH_PASSWORD_VALIDATORS = []
122 
123 if ADMIN:
124     AUTH_PASSWORD_VALIDATORS.extend(
125         [
126             {
127                 "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
128             },
129             {
130                 "NAME": "django.contrib.auth.password_validation.MinimumLengthValidator",
131             },
132             {
133                 "NAME": "django.contrib.auth.password_validation.CommonPasswordValidator",
134             },
135             {
136                 "NAME": "django.contrib.auth.password_validation.NumericPasswordValidator",
137             },
138         ]
139     )
140 
141 # Internationalization
142 
143 LANGUAGE_CODE = "en"
144 
145 LANGUAGES = [("en", "English"), ("es", "Español")]
146 
147 LOCALE_PATHS = [os.path.join(BASE_DIR, "benefits", "locale")]
148 
149 USE_I18N = True
150 USE_L10N = True
151 
152 TIME_ZONE = "UTC"
153 USE_TZ = True
154 
155 # Static files (CSS, JavaScript, Images)
156 
157 STATIC_URL = "/static/"
158 STATICFILES_DIRS = [os.path.join(BASE_DIR, "benefits", "static")]
159 STATIC_ROOT = os.path.join(BASE_DIR, "static")
160 
161 # Logging configuration
162 
163 LOG_LEVEL = os.environ.get("DJANGO_LOG_LEVEL", "DEBUG" if DEBUG else "WARNING")
164 LOGGING = {
165     "version": 1,
166     "disable_existing_loggers": False,
167     "formatters": {
168         "default": {
169             "format": "[{asctime}] {levelname} {name}:{lineno} {message}",
170             "datefmt": "%d/%b/%Y %H:%M:%S",
171             "style": "{",
172         },
173     },
174     "handlers": {
175         "default": {"class": "logging.StreamHandler", "formatter": "default"},
176     },
177     "root": {
178         "handlers": ["default"],
179         "level": LOG_LEVEL,
180     },
181     "loggers": {"django": {"handlers": ["default"], "propagate": False}},
182 }
183 
184 # Analytics configuration
185 
186 ANALYTICS_KEY = os.environ.get("ANALYTICS_KEY")
187
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/benefits/settings.py b/benefits/settings.py
--- a/benefits/settings.py
+++ b/benefits/settings.py
@@ -62,11 +62,13 @@
         ]
     )
 
+CSRF_COOKIE_AGE = None
+CSRF_COOKIE_SAMESITE = "Strict"
 CSRF_COOKIE_HTTPONLY = True
 
-SESSION_COOKIE_AGE = 3600
 SESSION_COOKIE_SAMESITE = "Strict"
 SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies"
+SESSION_EXPIRE_AT_BROWSER_CLOSE = True
 
 if not DEBUG:
     CSRF_COOKIE_SECURE = True

{"golden_diff": "diff --git a/benefits/settings.py b/benefits/settings.py\n--- a/benefits/settings.py\n+++ b/benefits/settings.py\n@@ -62,11 +62,13 @@\n         ]\n     )\n \n+CSRF_COOKIE_AGE = None\n+CSRF_COOKIE_SAMESITE = \"Strict\"\n CSRF_COOKIE_HTTPONLY = True\n \n-SESSION_COOKIE_AGE = 3600\n SESSION_COOKIE_SAMESITE = \"Strict\"\n SESSION_ENGINE = \"django.contrib.sessions.backends.signed_cookies\"\n+SESSION_EXPIRE_AT_BROWSER_CLOSE = True\n \n if not DEBUG:\n     CSRF_COOKIE_SECURE = True\n", "issue": "Secure critical Django cookies\nThe following can be configured in [`settings.py`](https://github.com/cal-itp/benefits/blob/dev/benefits/settings.py).\r\n\r\nSetting these ensures the cookies expire and are deleted when the user's browser closes (makes them session cookies)\r\n\r\n* [x] [`CSRF_COOKIE_AGE`](https://docs.djangoproject.com/en/3.2/ref/settings/#csrf-cookie-age) = None\r\n* [x] ~[`SESSION_COOKIE_AGE`](https://docs.djangoproject.com/en/3.2/ref/settings/#session-cookie-age) = None~\r\n* [x] [`SESSION_EXPIRE_AT_BROWSER_CLOSE `](https://docs.djangoproject.com/en/3.2/ref/settings/#session-cookie-age) = True\r\n\r\nWe also want to prevent the CSRF cookie from being sent in cross-browser requests. E.g. a user clicks on a link to our site, from another site - in this case we don't want any previous CSRF cookie already in their browser sent. It's unlikely to be an issue in our app since there are no user logins etc. but for consistency with our other cookies (session and language).\r\n\r\n* [x] [`CSRF_COOKIE_SAMESITE`](https://docs.djangoproject.com/en/3.2/ref/settings/#csrf-cookie-samesite) = \"Strict\"\n", "before_files": [{"content": "\"\"\"\nDjango settings for benefits project.\n\"\"\"\nimport os\n\n# Build paths inside the project like this: os.path.join(BASE_DIR, ...)\nBASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = os.environ[\"DJANGO_SECRET_KEY\"]\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = os.environ.get(\"DJANGO_DEBUG\", \"False\").lower() == \"true\"\n\nADMIN = os.environ.get(\"DJANGO_ADMIN\", \"False\").lower() == \"true\"\n\nALLOWED_HOSTS = []\n\nif DEBUG:\n    ALLOWED_HOSTS.extend([\"*\"])\nelse:\n    hosts = os.environ[\"DJANGO_ALLOWED_HOSTS\"].split(\",\")\n    ALLOWED_HOSTS.extend(hosts)\n\n# Application definition\n\nINSTALLED_APPS = [\n    \"django.contrib.sessions\",\n    \"django.contrib.staticfiles\",\n    \"benefits.core\",\n    \"benefits.enrollment\",\n    \"benefits.eligibility\",\n]\n\nif ADMIN:\n    INSTALLED_APPS.extend(\n        [\n            \"django.contrib.admin\",\n            \"django.contrib.auth\",\n            \"django.contrib.contenttypes\",\n            \"django.contrib.messages\",\n        ]\n    )\n\nMIDDLEWARE = [\n    \"django.middleware.security.SecurityMiddleware\",\n    \"django.contrib.sessions.middleware.SessionMiddleware\",\n    \"django.middleware.locale.LocaleMiddleware\",\n    \"benefits.core.middleware.Healthcheck\",\n    \"django.middleware.common.CommonMiddleware\",\n    \"django.middleware.csrf.CsrfViewMiddleware\",\n    \"django.middleware.clickjacking.XFrameOptionsMiddleware\",\n    \"benefits.core.middleware.DebugSession\",\n    \"benefits.core.middleware.ChangedLanguageEvent\",\n]\n\nif ADMIN:\n    MIDDLEWARE.extend(\n        [\n            \"django.contrib.auth.middleware.AuthenticationMiddleware\",\n            \"django.contrib.messages.middleware.MessageMiddleware\",\n        ]\n    )\n\nCSRF_COOKIE_HTTPONLY = True\n\nSESSION_COOKIE_AGE = 3600\nSESSION_COOKIE_SAMESITE = \"Strict\"\nSESSION_ENGINE = \"django.contrib.sessions.backends.signed_cookies\"\n\nif not DEBUG:\n    CSRF_COOKIE_SECURE = True\n    CSRF_FAILURE_VIEW = \"benefits.core.views.csrf_failure\"\n    SESSION_COOKIE_SECURE = True\n\nROOT_URLCONF = \"benefits.urls\"\n\ntemplate_ctx_processors = [\n    \"django.template.context_processors.request\",\n    \"benefits.core.context_processors.analytics\",\n]\n\nif DEBUG:\n    template_ctx_processors.extend(\n        [\n            \"django.template.context_processors.debug\",\n            \"benefits.core.context_processors.debug\",\n        ]\n    )\n\nif ADMIN:\n    template_ctx_processors.extend(\n        [\n            \"django.contrib.auth.context_processors.auth\",\n            \"django.contrib.messages.context_processors.messages\",\n        ]\n    )\n\nTEMPLATES = [\n    {\n        \"BACKEND\": \"django.template.backends.django.DjangoTemplates\",\n        \"DIRS\": [os.path.join(BASE_DIR, \"benefits\", \"templates\")],\n        \"APP_DIRS\": True,\n        \"OPTIONS\": {\n            \"context_processors\": template_ctx_processors,\n        },\n    },\n]\n\nWSGI_APPLICATION = \"benefits.wsgi.application\"\n\nDATABASES = {\n    \"default\": {\n        \"ENGINE\": \"django.db.backends.sqlite3\",\n        \"NAME\": os.environ.get(\"DJANGO_DB\", \"django\") + \".db\",\n    }\n}\n\n# Password validation\n\nAUTH_PASSWORD_VALIDATORS = []\n\nif ADMIN:\n    AUTH_PASSWORD_VALIDATORS.extend(\n        [\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.UserAttributeSimilarityValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.MinimumLengthValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.CommonPasswordValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.NumericPasswordValidator\",\n            },\n        ]\n    )\n\n# Internationalization\n\nLANGUAGE_CODE = \"en\"\n\nLANGUAGES = [(\"en\", \"English\"), (\"es\", \"Espa\u00f1ol\")]\n\nLOCALE_PATHS = [os.path.join(BASE_DIR, \"benefits\", \"locale\")]\n\nUSE_I18N = True\nUSE_L10N = True\n\nTIME_ZONE = \"UTC\"\nUSE_TZ = True\n\n# Static files (CSS, JavaScript, Images)\n\nSTATIC_URL = \"/static/\"\nSTATICFILES_DIRS = [os.path.join(BASE_DIR, \"benefits\", \"static\")]\nSTATIC_ROOT = os.path.join(BASE_DIR, \"static\")\n\n# Logging configuration\n\nLOG_LEVEL = os.environ.get(\"DJANGO_LOG_LEVEL\", \"DEBUG\" if DEBUG else \"WARNING\")\nLOGGING = {\n    \"version\": 1,\n    \"disable_existing_loggers\": False,\n    \"formatters\": {\n        \"default\": {\n            \"format\": \"[{asctime}] {levelname} {name}:{lineno} {message}\",\n            \"datefmt\": \"%d/%b/%Y %H:%M:%S\",\n            \"style\": \"{\",\n        },\n    },\n    \"handlers\": {\n        \"default\": {\"class\": \"logging.StreamHandler\", \"formatter\": \"default\"},\n    },\n    \"root\": {\n        \"handlers\": [\"default\"],\n        \"level\": LOG_LEVEL,\n    },\n    \"loggers\": {\"django\": {\"handlers\": [\"default\"], \"propagate\": False}},\n}\n\n# Analytics configuration\n\nANALYTICS_KEY = os.environ.get(\"ANALYTICS_KEY\")\n", "path": "benefits/settings.py"}], "after_files": [{"content": "\"\"\"\nDjango settings for benefits project.\n\"\"\"\nimport os\n\n# Build paths inside the project like this: os.path.join(BASE_DIR, ...)\nBASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))\n\n# SECURITY WARNING: keep the secret key used in production secret!\nSECRET_KEY = os.environ[\"DJANGO_SECRET_KEY\"]\n\n# SECURITY WARNING: don't run with debug turned on in production!\nDEBUG = os.environ.get(\"DJANGO_DEBUG\", \"False\").lower() == \"true\"\n\nADMIN = os.environ.get(\"DJANGO_ADMIN\", \"False\").lower() == \"true\"\n\nALLOWED_HOSTS = []\n\nif DEBUG:\n    ALLOWED_HOSTS.extend([\"*\"])\nelse:\n    hosts = os.environ[\"DJANGO_ALLOWED_HOSTS\"].split(\",\")\n    ALLOWED_HOSTS.extend(hosts)\n\n# Application definition\n\nINSTALLED_APPS = [\n    \"django.contrib.sessions\",\n    \"django.contrib.staticfiles\",\n    \"benefits.core\",\n    \"benefits.enrollment\",\n    \"benefits.eligibility\",\n]\n\nif ADMIN:\n    INSTALLED_APPS.extend(\n        [\n            \"django.contrib.admin\",\n            \"django.contrib.auth\",\n            \"django.contrib.contenttypes\",\n            \"django.contrib.messages\",\n        ]\n    )\n\nMIDDLEWARE = [\n    \"django.middleware.security.SecurityMiddleware\",\n    \"django.contrib.sessions.middleware.SessionMiddleware\",\n    \"django.middleware.locale.LocaleMiddleware\",\n    \"benefits.core.middleware.Healthcheck\",\n    \"django.middleware.common.CommonMiddleware\",\n    \"django.middleware.csrf.CsrfViewMiddleware\",\n    \"django.middleware.clickjacking.XFrameOptionsMiddleware\",\n    \"benefits.core.middleware.DebugSession\",\n    \"benefits.core.middleware.ChangedLanguageEvent\",\n]\n\nif ADMIN:\n    MIDDLEWARE.extend(\n        [\n            \"django.contrib.auth.middleware.AuthenticationMiddleware\",\n            \"django.contrib.messages.middleware.MessageMiddleware\",\n        ]\n    )\n\nCSRF_COOKIE_AGE = None\nCSRF_COOKIE_SAMESITE = \"Strict\"\nCSRF_COOKIE_HTTPONLY = True\n\nSESSION_COOKIE_SAMESITE = \"Strict\"\nSESSION_ENGINE = \"django.contrib.sessions.backends.signed_cookies\"\nSESSION_EXPIRE_AT_BROWSER_CLOSE = True\n\nif not DEBUG:\n    CSRF_COOKIE_SECURE = True\n    CSRF_FAILURE_VIEW = \"benefits.core.views.csrf_failure\"\n    SESSION_COOKIE_SECURE = True\n\nROOT_URLCONF = \"benefits.urls\"\n\ntemplate_ctx_processors = [\n    \"django.template.context_processors.request\",\n    \"benefits.core.context_processors.analytics\",\n]\n\nif DEBUG:\n    template_ctx_processors.extend(\n        [\n            \"django.template.context_processors.debug\",\n            \"benefits.core.context_processors.debug\",\n        ]\n    )\n\nif ADMIN:\n    template_ctx_processors.extend(\n        [\n            \"django.contrib.auth.context_processors.auth\",\n            \"django.contrib.messages.context_processors.messages\",\n        ]\n    )\n\nTEMPLATES = [\n    {\n        \"BACKEND\": \"django.template.backends.django.DjangoTemplates\",\n        \"DIRS\": [os.path.join(BASE_DIR, \"benefits\", \"templates\")],\n        \"APP_DIRS\": True,\n        \"OPTIONS\": {\n            \"context_processors\": template_ctx_processors,\n        },\n    },\n]\n\nWSGI_APPLICATION = \"benefits.wsgi.application\"\n\nDATABASES = {\n    \"default\": {\n        \"ENGINE\": \"django.db.backends.sqlite3\",\n        \"NAME\": os.environ.get(\"DJANGO_DB\", \"django\") + \".db\",\n    }\n}\n\n# Password validation\n\nAUTH_PASSWORD_VALIDATORS = []\n\nif ADMIN:\n    AUTH_PASSWORD_VALIDATORS.extend(\n        [\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.UserAttributeSimilarityValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.MinimumLengthValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.CommonPasswordValidator\",\n            },\n            {\n                \"NAME\": \"django.contrib.auth.password_validation.NumericPasswordValidator\",\n            },\n        ]\n    )\n\n# Internationalization\n\nLANGUAGE_CODE = \"en\"\n\nLANGUAGES = [(\"en\", \"English\"), (\"es\", \"Espa\u00f1ol\")]\n\nLOCALE_PATHS = [os.path.join(BASE_DIR, \"benefits\", \"locale\")]\n\nUSE_I18N = True\nUSE_L10N = True\n\nTIME_ZONE = \"UTC\"\nUSE_TZ = True\n\n# Static files (CSS, JavaScript, Images)\n\nSTATIC_URL = \"/static/\"\nSTATICFILES_DIRS = [os.path.join(BASE_DIR, \"benefits\", \"static\")]\nSTATIC_ROOT = os.path.join(BASE_DIR, \"static\")\n\n# Logging configuration\n\nLOG_LEVEL = os.environ.get(\"DJANGO_LOG_LEVEL\", \"DEBUG\" if DEBUG else \"WARNING\")\nLOGGING = {\n    \"version\": 1,\n    \"disable_existing_loggers\": False,\n    \"formatters\": {\n        \"default\": {\n            \"format\": \"[{asctime}] {levelname} {name}:{lineno} {message}\",\n            \"datefmt\": \"%d/%b/%Y %H:%M:%S\",\n            \"style\": \"{\",\n        },\n    },\n    \"handlers\": {\n        \"default\": {\"class\": \"logging.StreamHandler\", \"formatter\": \"default\"},\n    },\n    \"root\": {\n        \"handlers\": [\"default\"],\n        \"level\": LOG_LEVEL,\n    },\n    \"loggers\": {\"django\": {\"handlers\": [\"default\"], \"propagate\": False}},\n}\n\n# Analytics configuration\n\nANALYTICS_KEY = os.environ.get(\"ANALYTICS_KEY\")\n", "path": "benefits/settings.py"}]}