At the moment my django site's email confirmation links are not clickable for about 60 seconds. However, if I open them using right click open in new incognito window they work.
I do have the following setting -- so the 60 seconds makes sense.
SECURE_HSTS_SECONDS = 60
This, from my understanding at least, is due to this setting in my production settings.py
SECURE_HSTS_INCLUDE_SUBDOMAINS = env.bool( 'DJANGO_SECURE_HSTS_INCLUDE_SUBDOMAINS', default=True)
When I remove the include subdomains setting, I can click my links and all is well. I want users to be able to sign up, but I also don't want to compromise security.
My email confirmation link is also being sent as http, as opposed to https. I am trying to get the link to generate as https, but have been unsuccessful. How big of a risk does sending the email confirmations as http pose?
I'm currently using mailgun to handle my emails and they don't support HSTS. So I am trying to figure out how necessary HSTS is, and if I should simply not be concerned about it, or find another service / workaround.
Here is another post I made on StackOverflow trying to figure this all out if you'd like more details.
Thanks in advance. Been stuck on this for weeks.