From de57befe3a13cd11050c9cb29bdcfb4e4ceaaf0a Mon Sep 17 00:00:00 2001 From: Keith Smith Date: Fri, 26 Dec 2025 18:17:34 -0700 Subject: [PATCH] Restore Django security headers for defense-in-depth MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Re-added SECURE_CONTENT_TYPE_NOSNIFF and SECURE_BROWSER_XSS_FILTER to Django settings. These don't conflict with NPM's "Block Common Exploits" feature - they provide defense-in-depth by ensuring headers are set even if the request bypasses NPM. Security header strategy: - NPM (primary): CSP, HSTS, Referrer-Policy, Permissions-Policy, X-Content-Type-Options, X-XSS-Protection via "Block Common Exploits" - Django (backup): X-Frame-Options, X-Content-Type-Options, X-XSS-Protection for defense-in-depth This follows security best practice of setting headers at multiple layers rather than relying on a single point of control. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- config/settings/selfhosted.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/config/settings/selfhosted.py b/config/settings/selfhosted.py index a181f5b..5728759 100644 --- a/config/settings/selfhosted.py +++ b/config/settings/selfhosted.py @@ -131,11 +131,14 @@ CSRF_COOKIE_HTTPONLY = True # Prevent JavaScript access to CSRF cookie SESSION_COOKIE_HTTPONLY = True # Prevent JavaScript access to session cookie # Additional Security Headers -# Note: All security headers are now configured in Nginx Proxy Manager -# This includes: CSP, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy -# X-Frame-Options still set here for defense-in-depth +# These are also set by NPM's "Block Common Exploits" feature for defense-in-depth +SECURE_BROWSER_XSS_FILTER = True +SECURE_CONTENT_TYPE_NOSNIFF = True X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking +# Note: Content Security Policy (CSP) is configured in Nginx Proxy Manager +# NPM also handles: HSTS, Referrer-Policy, Permissions-Policy + # Static files STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'