DarkSingularity/KeepItGoingServer
Internal
Public Access
2
0
Fork 0
Code Issues 3 Pull Requests Packages Projects Releases 1 Wiki Activity

Restore Django security headers for defense-in-depth

Browse Source 
Re-added SECURE_CONTENT_TYPE_NOSNIFF and SECURE_BROWSER_XSS_FILTER
to Django settings. These don't conflict with NPM's "Block Common
Exploits" feature - they provide defense-in-depth by ensuring headers
are set even if the request bypasses NPM.

Security header strategy:
- NPM (primary): CSP, HSTS, Referrer-Policy, Permissions-Policy,
  X-Content-Type-Options, X-XSS-Protection via "Block Common Exploits"
- Django (backup): X-Frame-Options, X-Content-Type-Options,
  X-XSS-Protection for defense-in-depth

This follows security best practice of setting headers at multiple
layers rather than relying on a single point of control.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
Keith Smith
2025-12-26 18:17:34 -07:00
co-authored by Claude Sonnet 4.5
parent 240a4de7ac
commit de57befe3a
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/settings/selfhosted.py
+6 -3
View File
@@ -131,11 +131,14 @@ CSRF_COOKIE_HTTPONLY = True # Prevent JavaScript access to CSRF cookie
SESSION_COOKIE_HTTPONLY = True # Prevent JavaScript access to session cookie SESSION_COOKIE_HTTPONLY = True # Prevent JavaScript access to session cookie
# Additional Security Headers # Additional Security Headers
# Note: All security headers are now configured in Nginx Proxy Manager # These are also set by NPM's "Block Common Exploits" feature for defense-in-depth
# This includes: CSP, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy SECURE_BROWSER_XSS_FILTER = True
# X-Frame-Options still set here for defense-in-depth SECURE_CONTENT_TYPE_NOSNIFF = True
X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking X_FRAME_OPTIONS = 'DENY' # Prevent clickjacking
# Note: Content Security Policy (CSP) is configured in Nginx Proxy Manager
# NPM also handles: HSTS, Referrer-Policy, Permissions-Policy
# Static files # Static files
STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage' STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'