diff mbox series

[error-report-web,1/2] Enable SecurityMiddleware and XFrameOptionsMiddleware.

Message ID 20261018015615.74684-3-tim.orling@konsulko.com
State New
Headers show
Series Fix deployment security checks | expand

Commit Message

Tim Orling Oct. 18, 2026, 1:54 a.m. UTC 
Fixes check --deploy W001 and W002: adds nosniff, Referrer-Policy,
Cross-Origin-Opener-Policy and X-Frame-Options: DENY. Use Django's
middleware order, which drops a duplicate SessionMiddleware.

AI-Generated: Claude Opus 5.5
Signed-off-by: Tim Orling <tim.orling@konsulko.com>
---
 Post/test.py               | 6 ++++++
 project/settings.py        | 7 +++----
 project/settings.py.docker | 7 +++----
 3 files changed, 12 insertions(+), 8 deletions(-)
diff mbox series

Patch

diff --git a/Post/test.py b/Post/test.py
index 77adc32..28982e4 100755
--- a/Post/test.py
+++ b/Post/test.py
@@ -267,6 +267,12 @@  class CSPTest(TestCase):
             self.assertNotIn("unsafe-inline", csp)
             self.assertNotIn("unsafe-eval", csp)
 
+    def test_security_headers(self):
+        response = self.client.get('/Statistics/')
+        self.assertEqual(response['X-Frame-Options'], 'DENY')
+        self.assertEqual(response['X-Content-Type-Options'], 'nosniff')
+        self.assertEqual(response['Referrer-Policy'], 'same-origin')
+
     def test_csp_report_only(self):
         with override_settings(CONTENT_SECURITY_POLICY_REPORT_ONLY=True):
             # New client so the middleware picks up the setting
diff --git a/project/settings.py b/project/settings.py
index 28e526b..97c179c 100644
--- a/project/settings.py
+++ b/project/settings.py
@@ -132,15 +132,14 @@  STATICFILES_FINDERS = (
 SECRET_KEY = 'changeme'
 
 MIDDLEWARE = [
-    'django.middleware.common.CommonMiddleware',
+    'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
-    'django.contrib.sessions.middleware.SessionMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'Post.middleware.ContentSecurityPolicyMiddleware',
-    # Uncomment the next line for simple clickjacking protection:
-    # 'django.middleware.clickjacking.XFrameOptionsMiddleware',
 ]
 
 ROOT_URLCONF = 'project.urls'
diff --git a/project/settings.py.docker b/project/settings.py.docker
index bce1347..70c9253 100644
--- a/project/settings.py.docker
+++ b/project/settings.py.docker
@@ -126,15 +126,14 @@  STATICFILES_FINDERS = (
 SECRET_KEY = os.environ.get('SECRET_KEY', 'changeme')
 
 MIDDLEWARE = [
-    'django.middleware.common.CommonMiddleware',
+    'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
+    'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
-    'django.contrib.sessions.middleware.SessionMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
+    'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'Post.middleware.ContentSecurityPolicyMiddleware',
-    # Uncomment the next line for simple clickjacking protection:
-    # 'django.middleware.clickjacking.XFrameOptionsMiddleware',
 ]
 
 ROOT_URLCONF = 'project.urls'