From 11b8541005a6214ca1f954fc69e48884b0ac90cb Mon Sep 17 00:00:00 2001
From: Jacques ROUSSEL <jacques.roussel@rouaje.com>
Date: Fri, 27 Sep 2024 18:43:21 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7(backend)=20fix=20configuration=20t?=
 =?UTF-8?q?o=20avoid=20different=20ssl=20warning?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix following warning messages :
- You have not set a value for the SECURE_HSTS_SECONDS setting.
- Your SECURE_SSL_REDIRECT setting is not set to True.
---
 src/backend/meet/settings.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/backend/meet/settings.py b/src/backend/meet/settings.py
index e438e372..bf2deaa5 100755
--- a/src/backend/meet/settings.py
+++ b/src/backend/meet/settings.py
@@ -549,6 +549,14 @@ class Production(Base):
     #
     # In other cases, you should comment the following line to avoid security issues.
     SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
+    SECURE_HSTS_SECONDS = 60
+    SECURE_HSTS_PRELOAD = True
+    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+    SECURE_SSL_REDIRECT = True
+    SECURE_REDIRECT_EXEMPT = [
+        "^__lbheartbeat__",
+        "^__heartbeat__",
+    ]
 
     # Modern browsers require to have the `secure` attribute on cookies with `Samesite=none`
     CSRF_COOKIE_SECURE = True