Django Production Security Settings

SECURE_HSTS_SECONDS Configuration

For SECURE_HSTS_SECONDS, you need to be careful as setting this incorrectly can make your site inaccessible for the duration you specify. This setting enables HTTP Strict Transport Security (HSTS), which tells browsers to only connect to your site using HTTPS.

A common approach is to start with a relatively low value during initial deployment, such as 3600 (1 hour), and then gradually increase it as you confirm everything works correctly:

PYTHONCopied
# Start with 1 hour
SECURE_HSTS_SECONDS = 3600

# Later, increase to 1 day, then 1 week, then 1 month
# SECURE_HSTS_SECONDS = 86400    # 1 day
# SECURE_HSTS_SECONDS = 604800   # 1 week
# SECURE_HSTS_SECONDS = 2592000  # 30 days

Once you're confident in your HTTPS setup, many sites use longer periods like 1 month (2592000) or even 1 year (31536000).

Recommended Security Settings

The settings recommended by the deployment check are indeed important:

PYTHONCopied
SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

These settings:

• Redirect HTTP requests to HTTPS
• Ensure session cookies are only sent over HTTPS
• Ensure CSRF cookies are only sent over HTTPS

However, for a comprehensive security setup, consider adding these additional settings:

PYTHONCopied
# HSTS subdomains and preload list
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

# Prevent clickjacking
X_FRAME_OPTIONS = 'DENY'

# Enable browser XSS protection
SECURE_BROWSER_XSS_FILTER = True

# Prevent MIME type sniffing
SECURE_CONTENT_TYPE_NOSNIFF = True

If you're using a reverse proxy (which is common with services like Render), you may also need to configure:

PYTHONCopied
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

However, be extremely careful with this setting as incorrect configuration can lead to CSRF vulnerabilities. Only use it if your hosting provider specifically requires it and you understand the implications.

Remember that these security settings should be part of your deployment checklist, along with other production-specific configurations for performance and error reporting.