Add HTTPS options on production

ccwang002 · ccwang002 · commit f815f97723d6 · 2016-02-21T01:11:36.000+08:00
diff --git a/pydoc_autobuild/settings/production.py b/pydoc_autobuild/settings/production.py
@@ -35,6 +35,18 @@
 # Increase default timeout time
 Q_CLUSTER['timeout'] = 3600
 
+
+# Securiy related settings
+SECURE_HSTS_SECONDS = 2592000
+SECURE_BROWSER_XSS_FILTER = True
+SECURE_CONTENT_TYPE_NOSNIFF=True
+SESSION_COOKIE_SECURE = True
+CSRF_COOKIE_SECURE = True
+CSRF_COOKIE_HTTPONLY = True
+SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
+X_FRAME_OPTIONS = 'DENY'
+
+
 # Log everything to the logs directory at the top
 LOGFILE_ROOT = join(BASE_DIR, 'logs')
 
