Configure the security middleware
@@ -70,6 +70,12 @@ class CommunityBaseSettings(Settings):
CSRF_COOKIE_HTTPONLY = True
CSRF_COOKIE_AGE = 30 * 24 * 60 * 60
+ # Security & X-Frame-Options Middleware
+ # https://docs.djangoproject.com/en/1.11/ref/middleware/#django.middleware.security.SecurityMiddleware
+ SECURE_BROWSER_XSS_FILTER = True
+ SECURE_CONTENT_TYPE_NOSNIFF = True
+ X_FRAME_OPTIONS = 'DENY'
+
# Read the Docs
READ_THE_DOCS_EXTENSIONS = ext
RTD_LATEST = 'latest'
@@ -160,6 +166,7 @@ class CommunityBaseSettings(Settings):
'django.middleware.common.CommonMiddleware',
'django.middleware.security.SecurityMiddleware',
'django.middleware.csrf.CsrfViewMiddleware',
+ 'django.middleware.clickjacking.XFrameOptionsMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
'dj_pagination.middleware.PaginationMiddleware',
