mohamad
4bcb5f196d
The live hostname is comp2care.com while the previous configuration only trusted com2care.com. Always include both production domain variants so stale environment overrides cannot block admin login.
43 lines
949 B
Python
43 lines
949 B
Python
import os
|
|
|
|
from .base import * # noqa: F401, F403
|
|
|
|
SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
|
|
|
|
DEBUG = False
|
|
|
|
PRODUCTION_HOSTS = {
|
|
"com2care.com",
|
|
"www.com2care.com",
|
|
"comp2care.com",
|
|
"www.comp2care.com",
|
|
}
|
|
|
|
ALLOWED_HOSTS = sorted(
|
|
PRODUCTION_HOSTS
|
|
| {
|
|
host.strip()
|
|
for host in os.environ.get("ALLOWED_HOSTS", "").split(",")
|
|
if host.strip()
|
|
}
|
|
)
|
|
|
|
SECURE_HSTS_SECONDS = 31536000
|
|
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
|
|
SECURE_HSTS_PRELOAD = True
|
|
SECURE_SSL_REDIRECT = os.environ.get("SECURE_SSL_REDIRECT", "True") == "True"
|
|
SESSION_COOKIE_SECURE = True
|
|
CSRF_COOKIE_SECURE = True
|
|
SECURE_BROWSER_XSS_FILTER = True
|
|
SECURE_CONTENT_TYPE_NOSNIFF = True
|
|
X_FRAME_OPTIONS = "DENY"
|
|
|
|
CSRF_TRUSTED_ORIGINS = sorted(
|
|
{f"https://{host}" for host in PRODUCTION_HOSTS}
|
|
| {
|
|
origin.strip()
|
|
for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
|
|
if origin.strip()
|
|
}
|
|
)
|