openedx / openedx/edx-cookiecutters
Set default security headers in Django template
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 30
- Forks
- 35
- PR merge metrics
- No merged PRs in 30d
Description
We have an opportunity to start out all new Django services with strict CSP, HSTS, and other good security defaults. These can then be changed as needed as the application grows and changes.
(Strict CSP is very easy to achieve in a brand-new application, and more painful to achieve in an existing application.)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Django service template and reviewing how generated applications configure HTTP responses and security settings. Compare the available template configuration with Django's CSP, HSTS, and related security defaults; the work is done when newly generated services apply documented secure defaults without preventing later customization.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django, python
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100