0
votes
1answer
34 views

Secure Django Application

What are some of the recommended configuration settings to secure your Django application? i.e. best practices for settings.py file. I researched and came across some: SESSION_COOKIE_SECURE = True ...
5
votes
1answer
226 views

What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft

I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
16
votes
1answer
3k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
8
votes
1answer
718 views

Strict Transport Security — max_age value

I've been wondering what max-age should the HTTP Strict Transport Security header have. Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes) market.android.com has it ...
11
votes
6answers
2k views

Is there a security risk running web apps in debug=“true”?

This is a copy of the original question on Stack Overflow which didn't get much love and is probably more relevant here: There are plenty of performance reasons why apps shouldn't be run in ...