Add security option in production

2016-04-30 08:57:09 +02:00 · 2016-04-30 08:57:09 +02:00 · d069380e80
parent 3741436368
commit d069380e80
1 changed files with 8 additions and 1 deletions
--- a/gwift/gwift/settings/production.py
+++ b/gwift/gwift/settings/production.py
@ -19,4 +19,11 @@ AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django.contrib.auth.password_validation.NumericPasswordValidator',
    },
-]
+]
+
+# Be sure to force https for csrf cookie
+CSRF_COOKIE_SECURE = True
+
+# Same for session cookie
+SESSION_COOKIE_SECURE = True
+