add CSRF_COOKIE_SECURE setting in production (#145)

westerveltco · May 2, 2024 · e341b78 · e341b78
1 parent ec4e105
commit e341b78
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -22,6 +22,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Repo now has a `CODEOWNERS` file to automatically assign reviewers to pull requests. (Template already has one.)
 - Added a new, separate Dependabot group for `django-email-relay` updates.
 - Added Docker to Dependabot updates.
+- Added `CSRF_COOKIE_SECURE = not DEBUG` to the Django settings template.
 
 ## [2024.19]
 

diff --git a/src/django_twc_project/{{ module_name }}/settings.py.jinja b/src/django_twc_project/{{ module_name }}/settings.py.jinja
@@ -52,6 +52,8 @@ ALLOWED_HOSTS = env.list("ALLOWED_HOSTS", default=["*"] if DEBUG else ["localhos
 
 ASGI_APPLICATION = "{{ module_name }}.asgi.application"
 
+CSRF_COOKIE_SECURE = not DEBUG
+
 DATABASES = {
  "default": env.dj_db_url(
  "DATABASE_URL",