From 026259b4f4dacda633760c8b2c545e0806d26d24 Mon Sep 17 00:00:00 2001
From: Keith Smith <keith@firebugit.com>
Date: Tue, 23 Dec 2025 06:22:14 -0700
Subject: [PATCH] Fix HIGH Security Issue: Add comprehensive security headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added comprehensive security headers to prevent XSS, clickjacking, and other attacks.

Security Headers Added:
- SECURE_BROWSER_XSS_FILTER: Enable XSS filter
- SECURE_CONTENT_TYPE_NOSNIFF: Prevent MIME-type sniffing
- X_FRAME_OPTIONS: DENY to prevent clickjacking
- SECURE_REFERRER_POLICY: Control referrer information

Cookie Security:
- SESSION_COOKIE_HTTPONLY: Prevent JavaScript access to session cookies
- SESSION_COOKIE_SAMESITE: Strict to prevent CSRF
- CSRF_COOKIE_HTTPONLY: Prevent JavaScript access to CSRF tokens
- CSRF_COOKIE_SAMESITE: Strict protection

Content Security Policy (CSP):
- CSP_DEFAULT_SRC: Only allow same-origin resources
- CSP_SCRIPT_SRC: Restrict script execution to same-origin
- CSP_STYLE_SRC: Restrict stylesheets to same-origin
- CSP_IMG_SRC: Allow images from same-origin, data URIs, and HTTPS
- CSP_FRAME_ANCESTORS: Prevent embedding in iframes ('none')
- CSP_FORM_ACTION: Restrict form submissions to same-origin

CSRF Protection:
- Added CSRF_TRUSTED_ORIGINS configuration for cross-origin requests

Security impact:
- Prevents clickjacking attacks
- Mitigates XSS vulnerabilities
- Blocks MIME-type confusion attacks
- Protects cookies from JavaScript theft
- Enforces strict CSP to prevent code injection

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 config/settings/production.py | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/config/settings/production.py b/config/settings/production.py
index f972aa9..5bbd7ef 100644
--- a/config/settings/production.py
+++ b/config/settings/production.py
@@ -21,6 +21,30 @@ SECURE_HSTS_SECONDS = 31536000  # 1 year
 SECURE_HSTS_INCLUDE_SUBDOMAINS = True
 SECURE_HSTS_PRELOAD = True
 
+# Security Headers
+SECURE_BROWSER_XSS_FILTER = True
+SECURE_CONTENT_TYPE_NOSNIFF = True
+X_FRAME_OPTIONS = 'DENY'  # Prevents clickjacking
+SECURE_REFERRER_POLICY = 'strict-origin-when-cross-origin'
+
+# Cookie Security
+SESSION_COOKIE_HTTPONLY = True
+SESSION_COOKIE_SAMESITE = 'Strict'
+CSRF_COOKIE_HTTPONLY = True
+CSRF_COOKIE_SAMESITE = 'Strict'
+
+# Content Security Policy (CSP)
+# Note: Adjust as needed based on your frontend requirements
+CSP_DEFAULT_SRC = ("'self'",)
+CSP_SCRIPT_SRC = ("'self'",)  # Remove 'unsafe-inline' if possible
+CSP_STYLE_SRC = ("'self'",)   # Remove 'unsafe-inline' if possible
+CSP_IMG_SRC = ("'self'", "data:", "https:")
+CSP_FONT_SRC = ("'self'",)
+CSP_CONNECT_SRC = ("'self'",)
+CSP_FRAME_ANCESTORS = ("'none'",)  # Prevents embedding in iframes
+CSP_BASE_URI = ("'self'",)
+CSP_FORM_ACTION = ("'self'",)
+
 # Database
 import dj_database_url
 DATABASES = {
@@ -46,6 +70,9 @@ CACHES = {
 # CORS
 CORS_ALLOWED_ORIGINS = os.environ.get('CORS_ALLOWED_ORIGINS', '').split(',')
 
+# CSRF
+CSRF_TRUSTED_ORIGINS = os.environ.get('CSRF_TRUSTED_ORIGINS', '').split(',') if os.environ.get('CSRF_TRUSTED_ORIGINS') else []
+
 # Static files
 STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'