From 240a4de7ac22b69500a037c397a8eeab7226e98e Mon Sep 17 00:00:00 2001 From: Keith Smith Date: Fri, 26 Dec 2025 18:13:32 -0700 Subject: [PATCH] Remove duplicate security headers - handled by NPM MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Removed SECURE_CONTENT_TYPE_NOSNIFF and SECURE_BROWSER_XSS_FILTER from Django settings to prevent duplicate headers. These headers are now exclusively managed in Nginx Proxy Manager's Advanced config. This fixes Mozilla Observatory error: "X-Content-Type-Options header cannot be recognized" which was caused by the header being sent twice (once from Django, once from NPM). Security headers now managed in NPM: - Content-Security-Policy - X-Content-Type-Options - X-XSS-Protection - Referrer-Policy - Permissions-Policy X-Frame-Options kept in Django for defense-in-depth (doesn't conflict). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- config/settings/selfhosted.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/config/settings/selfhosted.py b/config/settings/selfhosted.py index b98b551..a181f5b 100644 --- a/config/settings/selfhosted.py +++ b/config/settings/selfhosted.py @@ -131,13 +131,11 @@ CSRF_COOKIE_HTTPONLY = True # Prevent JavaScript access to CSRF cookie SESSION_COOKIE_HTTPONLY = True # Prevent JavaScript access to session cookie # Additional Security Headers -SECURE_BROWSER_XSS_FILTER = True -SECURE_CONTENT_TYPE_NOSNIFF = True +# Note: All security headers are now configured in Nginx Proxy Manager +# This includes: CSP, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy +# X-Frame-Options still set here for defense-in-depth X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking -# Note: Content Security Policy (CSP) is configured in Nginx Proxy Manager -# See NPM Advanced config for CSP header configuration - # Static files STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'