Keith SmithandClaude Sonnet 4.5 19ff672562 Update security settings for NPM SSL/HSTS handling ...

Since Nginx Proxy Manager handles SSL termination, Force SSL, and HSTS:
- Set SECURE_HSTS_SECONDS = 0 (NPM sends HSTS headers)
- Added SECURE_PROXY_SSL_HEADER to trust X-Forwarded-Proto from NPM
- Added SESSION_COOKIE_HTTPONLY for additional session security
- Documented NPM configuration: Force SSL = On, HSTS Enabled = On

This prevents duplicate HSTS headers and ensures Django correctly
detects HTTPS connections behind the reverse proxy.

Cookie security (SESSION/CSRF_COOKIE_SECURE) remains enabled as these
are application-level settings independent of the reverse proxy.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2025-12-26 17:34:03 -07:00

..

__init__.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

base.py

Fix HIGH Security Issue: Add file upload validation for avatars

2025-12-23 06:23:11 -07:00

development.py

Add tasks.firebugit.com to development server configuration

2025-12-23 06:08:39 -07:00

production.py

Fix HIGH Security Issue: Require ALLOWED_HOSTS in production

2025-12-23 06:23:34 -07:00

selfhosted.py

Update security settings for NPM SSL/HSTS handling

2025-12-26 17:34:03 -07:00