DarkSingularity/KeepItGoingServer
Internal
Public Access
2
0
Fork 0
Code Issues 3 Pull Requests Packages Projects Releases 1 Wiki Activity

Remove duplicate security headers - handled by NPM

Browse Source 
Removed SECURE_CONTENT_TYPE_NOSNIFF and SECURE_BROWSER_XSS_FILTER
from Django settings to prevent duplicate headers. These headers are
now exclusively managed in Nginx Proxy Manager's Advanced config.

This fixes Mozilla Observatory error: "X-Content-Type-Options header
cannot be recognized" which was caused by the header being sent twice
(once from Django, once from NPM).

Security headers now managed in NPM:
- Content-Security-Policy
- X-Content-Type-Options
- X-XSS-Protection
- Referrer-Policy
- Permissions-Policy

X-Frame-Options kept in Django for defense-in-depth (doesn't conflict).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
Keith Smith
2025-12-26 18:13:32 -07:00
co-authored by Claude Sonnet 4.5
parent 5e2b13afe3
commit 240a4de7ac
1 changed files with 3 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/settings/selfhosted.py
+3 -5
View File
@@ -131,13 +131,11 @@ CSRF_COOKIE_HTTPONLY = True # Prevent JavaScript access to CSRF cookie
SESSION_COOKIE_HTTPONLY = True # Prevent JavaScript access to session cookie SESSION_COOKIE_HTTPONLY = True # Prevent JavaScript access to session cookie
# Additional Security Headers # Additional Security Headers
SECURE_BROWSER_XSS_FILTER = True # Note: All security headers are now configured in Nginx Proxy Manager
SECURE_CONTENT_TYPE_NOSNIFF = True # This includes: CSP, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy
# X-Frame-Options still set here for defense-in-depth
X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking
# Note: Content Security Policy (CSP) is configured in Nginx Proxy Manager
# See NPM Advanced config for CSP header configuration
# Static files # Static files
STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage' STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'