Your website is vulnerable because the SESSION_COOKIE_SECURE setting is not set - so hackers have an easier time stealing your users' session cookies on HTTP connections.

SessionMiddleware marks the session cookie as secure when SESSION_COOKIE_SECURE = True, to make the browser only send cookie over secure HTTPS connection.

Cookies sent over insecure HTTP are unencrypted, so hackers can steal the session cookie using a packet sniffer - allowing them to effectively copy and paste it into their browser and be logged in as the user.

So in practice, do this

import os

MIDDLEWARE = [
    'django.contrib.sessions.middleware.SessionMiddleware',
    ...
]

# allow it to be turned off in local dev env.
SESSION_COOKIE_SECURE = os.getenv('SESSION_COOKIE_SECURE', True)

Instead of this

MIDDLEWARE = [
    'django.contrib.sessions.middleware.SessionMiddleware',
    ...
]