fairdm.conf.settings.security#
Security settings: SECRET_KEY, ALLOWED_HOSTS, DEBUG and the HTTPS, cookie and HSTS headers.
Owns these settings and applies them unconditionally, without branching on the environment.
Relaxing them for local development is development.py’s job. A portal supplies
CSRF_TRUSTED_ORIGINS beyond what ALLOWED_HOSTS implies, and any additional security
middleware.
Neither SECRET_KEY nor the site domain has a working default. An unset value resolves to an
unusable sentinel and the read never raises; fairdm.conf.checks refuses a production
boot on the result.
Module Contents#
Data#
API#
- env#
None
- SECRET_KEY#
‘env(…)’
- ALLOWED_HOSTS#
None
- CSRF_TRUSTED_ORIGINS#
None
- DEBUG#
‘bool(…)’
- SESSION_COOKIE_HTTPONLY#
True
- CSRF_COOKIE_HTTPONLY#
False
- SECURE_BROWSER_XSS_FILTER#
True
- X_FRAME_OPTIONS#
‘DENY’
- SECURE_SSL_REDIRECT#
‘bool(…)’
- SECURE_PROXY_SSL_HEADER#
(‘HTTP_X_FORWARDED_PROTO’, ‘https’)
- SESSION_COOKIE_SECURE#
True
- SESSION_COOKIE_NAME#
‘__Secure-sessionid’
- CSRF_COOKIE_SECURE#
True
- CSRF_COOKIE_NAME#
‘__Secure-csrftoken’
- SECURE_HSTS_PRELOAD#
‘bool(…)’
- SECURE_HSTS_SECONDS#
60
- SECURE_HSTS_INCLUDE_SUBDOMAINS#
‘bool(…)’
- SECURE_CONTENT_TYPE_NOSNIFF#
‘bool(…)’