From 009e1149d78f81957cf05dc83c5391cc36f7b478 Mon Sep 17 00:00:00 2001 From: Lukas Winkler Date: Mon, 1 Jun 2020 11:12:37 +0200 Subject: [PATCH] improve settings --- acronomy/settings.py | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/acronomy/settings.py b/acronomy/settings.py index 73a21fa..87ad45c 100644 --- a/acronomy/settings.py +++ b/acronomy/settings.py @@ -9,9 +9,10 @@ https://docs.djangoproject.com/en/3.0/topics/settings/ For the full list of settings and their values, see https://docs.djangoproject.com/en/3.0/ref/settings/ """ - import os +from .secrets import * + # Build paths inside the project like this: os.path.join(BASE_DIR, ...) BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) @@ -19,7 +20,7 @@ BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__))) # See https://docs.djangoproject.com/en/3.0/howto/deployment/checklist/ -ALLOWED_HOSTS = [] +ALLOWED_HOSTS = ["127.0.0.1", "acronomy.lw1.at"] # Application definition @@ -108,7 +109,6 @@ USE_TZ = True STATIC_URL = '/static/' - MEDIA_URL = '/media/' STATICFILES_DIRS = [ @@ -125,3 +125,15 @@ INTERNAL_IPS = [ ] TAGGIT_CASE_INSENSITIVE = True + +SECURE_SSL_REDIRECT = True +SECURE_BROWSER_XSS_FILTER = True +SECURE_CONTENT_TYPE_NOSNIFF = True +X_FRAME_OPTIONS = 'DENY' +SECURE_REFERRER_POLICY = "origin-when-cross-origin" + +if Production: + SECURE_HSTS_SECONDS = 60 * 60 * 24 * 365 + SECURE_HSTS_INCLUDE_SUBDOMAINS = True + SESSION_COOKIE_SECURE = True + CSRF_COOKIE_SECURE = True