Keith SmithandClaude Sonnet 4.5 19ff672562 Update security settings for NPM SSL/HSTS handling ...

Since Nginx Proxy Manager handles SSL termination, Force SSL, and HSTS:
- Set SECURE_HSTS_SECONDS = 0 (NPM sends HSTS headers)
- Added SECURE_PROXY_SSL_HEADER to trust X-Forwarded-Proto from NPM
- Added SESSION_COOKIE_HTTPONLY for additional session security
- Documented NPM configuration: Force SSL = On, HSTS Enabled = On

This prevents duplicate HSTS headers and ensures Django correctly
detects HTTPS connections behind the reverse proxy.

Cookie security (SESSION/CSRF_COOKIE_SECURE) remains enabled as these
are application-level settings independent of the reverse proxy.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2025-12-26 17:34:03 -07:00

..

settings

Update security settings for NPM SSL/HSTS handling

2025-12-26 17:34:03 -07:00

__init__.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

asgi.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

celery.py

Fix Critical Security Issue: Replace print() with proper logging

2025-12-22 22:34:57 -07:00

urls.py

Add API root endpoint at /api/

2025-12-26 17:24:16 -07:00

views.py

Add API root endpoint at /api/

2025-12-26 17:24:16 -07:00

wsgi.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00