From 19ff6725621abbd6b846adc6b7927f96a7174415 Mon Sep 17 00:00:00 2001 From: Keith Smith Date: Fri, 26 Dec 2025 17:34:03 -0700 Subject: [PATCH] Update security settings for NPM SSL/HSTS handling MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Since Nginx Proxy Manager handles SSL termination, Force SSL, and HSTS: - Set SECURE_HSTS_SECONDS = 0 (NPM sends HSTS headers) - Added SECURE_PROXY_SSL_HEADER to trust X-Forwarded-Proto from NPM - Added SESSION_COOKIE_HTTPONLY for additional session security - Documented NPM configuration: Force SSL = On, HSTS Enabled = On This prevents duplicate HSTS headers and ensures Django correctly detects HTTPS connections behind the reverse proxy. Cookie security (SESSION/CSRF_COOKIE_SECURE) remains enabled as these are application-level settings independent of the reverse proxy. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- config/settings/selfhosted.py | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/config/settings/selfhosted.py b/config/settings/selfhosted.py index 6b69d6f..8fc0480 100644 --- a/config/settings/selfhosted.py +++ b/config/settings/selfhosted.py @@ -105,20 +105,22 @@ CSRF_TRUSTED_ORIGINS = os.environ.get( # =================================================================== # SSL/HTTPS Security -# Note: SECURE_SSL_REDIRECT is False because Nginx Proxy Manager handles SSL termination -# NPM redirects HTTP to HTTPS at the reverse proxy level -SECURE_SSL_REDIRECT = False # NPM handles this +# Note: SSL termination, HTTP→HTTPS redirect, and HSTS are handled by Nginx Proxy Manager +# NPM is configured with: Force SSL = On, HSTS Enabled = On +SECURE_SSL_REDIRECT = False # NPM handles HTTP→HTTPS redirect +SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') # Trust NPM's X-Forwarded-Proto header -# HTTP Strict Transport Security (HSTS) -# Tells browsers to always use HTTPS for this domain (1 year = 31536000 seconds) -SECURE_HSTS_SECONDS = 31536000 -SECURE_HSTS_INCLUDE_SUBDOMAINS = True -SECURE_HSTS_PRELOAD = True +# HSTS - Disabled in Django since NPM sends HSTS headers +# NPM is configured to send: Strict-Transport-Security: max-age=31536000 +# Enabling here would create duplicate headers +SECURE_HSTS_SECONDS = 0 # Disabled - NPM handles HSTS # Cookie Security +# These are still needed even though NPM handles SSL SESSION_COOKIE_SECURE = True # Only send session cookies over HTTPS CSRF_COOKIE_SECURE = True # Only send CSRF cookies over HTTPS CSRF_COOKIE_HTTPONLY = True # Prevent JavaScript access to CSRF cookie +SESSION_COOKIE_HTTPONLY = True # Prevent JavaScript access to session cookie # Additional Security Headers SECURE_BROWSER_XSS_FILTER = True