What are some of the recommended configuration settings to secure your Django application? i.e. best practices for settings.py file. I researched and came across some: SESSION_COOKIE_SECURE = True ...
What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft
I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status Where can I find the most current guidance on STS in DNS? If ...
The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
I've been wondering what max-age should the HTTP Strict Transport Security header have. Both paypal and lastpass sites leave it very low: 500 (seconds = bit over 8 minutes) market.android.com has it ...
This is a copy of the original question on Stack Overflow which didn't get much love and is probably more relevant here: There are plenty of performance reasons why apps shouldn't be run in ...