Merge pull request #201 from SubstraFoundation/http_settings

Secure http settings
Substra · Apr 8, 2020 · fc257e7 · fc257e7
2 parents 45866b5 + 3216563
commit fc257e7
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/backend/backend/settings/common.py b/backend/backend/settings/common.py
@@ -124,6 +124,10 @@ def to_bool(value):
 
 WSGI_APPLICATION = 'backend.wsgi.application'
 
+SECURE_CONTENT_TYPE_NOSNIFF = True
+SESSION_COOKIE_HTTPONLY = True
+CSRF_COOKIE_HTTPONLY = True
+
 # Database
 # https://docs.djangoproject.com/en/1.9/ref/settings/#databases
 

diff --git a/backend/backend/settings/prod.py b/backend/backend/settings/prod.py
@@ -14,6 +14,10 @@
 os.environ['HTTPS'] = "on"
 os.environ['wsgi.url_scheme'] = 'https'
 
+SECURE_HSTS_SECONDS = int(os.environ.get('SECURE_HSTS_SECONDS', 365 * 24 * 3600))  # 1 year
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+
 STATIC_URL = '/static/'
 STATIC_ROOT = os.path.join(BASE_DIR, 'statics')