Quick start¶
Default configuration¶
To apply default security headers to all responses:
Install from
pippip install django-security-headers
Add the
cspandsecurity_headersmiddlewareMIDDLEWARES = [ "django.middleware.security.SecurityMiddleware", "csp.middleware.CSPMiddleware", "security_headers.middleware.extra_security_headers", ... ]
Add the default
cspandsecurity_headerssettings by importing the defaults to your localsettings.pyfrom security_headers.defaults import *
Optional configuration¶
To permit framing from whitelisted domains, add security_headers to your INSTALLED_APPS.
INSTALLED_APPS = [
...
"security_headers",
...
]
This will expose a simple admin interface for specifying safe domains. To access template tags provided by django-csp, install csp as well
INSTALLED_APPS = [
...
"security_headers",
"csp",
...
]
Development settings¶
During development using http localhost server, you will need to overwrite some default settings that require SSL. At the very end of your settings.py file, include
CSRF_COOKIE_SECURE = not DEBUG
SECURE_SSL_REDIRECT = not DEBUG
SESSION_COOKIE_SECURE = not DEBUG
SECURE_HSTS_SECONDS = 3600
Reducing SECURE_HSTS_SECONDS time is also a good idea during development.