Django Doctor

Django security challenge

conf/settings.py

# Challenge 1/5: We're getting ready to make the website production-ready. Make it run on HTTPS only

INSTALLED_APPS = ['django.contrib.sessions', 'django.contrib.staticfiles']

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
]

ROOT_URLCONF = 'config.urls'

INSTALLED_APPS = ['django.contrib.sessions', 'django.contrib.staticfiles']

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
]

ROOT_URLCONF = 'config.urls'

Helpful links

Our blog post on Django security
Django security documentation
Django HSTS documentation