Keith SmithandClaude Sonnet 4.5 240a4de7ac Remove duplicate security headers - handled by NPM ...

Removed SECURE_CONTENT_TYPE_NOSNIFF and SECURE_BROWSER_XSS_FILTER
from Django settings to prevent duplicate headers. These headers are
now exclusively managed in Nginx Proxy Manager's Advanced config.

This fixes Mozilla Observatory error: "X-Content-Type-Options header
cannot be recognized" which was caused by the header being sent twice
(once from Django, once from NPM).

Security headers now managed in NPM:
- Content-Security-Policy
- X-Content-Type-Options
- X-XSS-Protection
- Referrer-Policy
- Permissions-Policy

X-Frame-Options kept in Django for defense-in-depth (doesn't conflict).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2025-12-26 18:13:32 -07:00

..

__init__.py

Initial commit: KeepItGoing task management server

2025-12-18 17:41:29 -07:00

base.py

Remove django-csp package - CSP now handled by NPM

2025-12-26 17:59:31 -07:00

development.py

Add tasks.firebugit.com to development server configuration

2025-12-23 06:08:39 -07:00

production.py

Fix HIGH Security Issue: Require ALLOWED_HOSTS in production

2025-12-23 06:23:34 -07:00

selfhosted.py

Remove duplicate security headers - handled by NPM

2025-12-26 18:13:32 -07:00