From 00fca071bf64c304c9b99fbaf0a65452bb3c3fed Mon Sep 17 00:00:00 2001 From: Keith Smith Date: Fri, 26 Dec 2025 17:36:13 -0700 Subject: [PATCH] Silence Django security warnings handled by NPM MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added SILENCED_SYSTEM_CHECKS to suppress warnings for: - security.W004: HSTS (handled by NPM with HSTS Enabled) - security.W008: SSL redirect (handled by NPM with Force SSL) These warnings are intentionally suppressed because the security features are properly configured at the reverse proxy level. After redeploying, 'manage.py check --deploy' will show: "System check identified no issues (0 silenced)." 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- config/settings/selfhosted.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/config/settings/selfhosted.py b/config/settings/selfhosted.py index 8fc0480..6a7ad25 100644 --- a/config/settings/selfhosted.py +++ b/config/settings/selfhosted.py @@ -115,6 +115,14 @@ SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') # Trust NPM's X-F # Enabling here would create duplicate headers SECURE_HSTS_SECONDS = 0 # Disabled - NPM handles HSTS +# Silence Django security warnings for settings handled by Nginx Proxy Manager +# W004: HSTS - NPM sends Strict-Transport-Security headers +# W008: SSL Redirect - NPM redirects HTTP to HTTPS +SILENCED_SYSTEM_CHECKS = [ + 'security.W004', # HSTS handled by NPM + 'security.W008', # SSL redirect handled by NPM +] + # Cookie Security # These are still needed even though NPM handles SSL SESSION_COOKIE_SECURE = True # Only send session cookies over HTTPS