SH015: Django does not enforce HTTPS

Severity: medium · Category: security · Applies to: django

Why it matters

Without SECURE_SSL_REDIRECT and HSTS, browsers keep using plain HTTP and session cookies and form data can be intercepted on the network.

How to fix

Set SECURE_SSL_REDIRECT = True and SECURE_HSTS_SECONDS to a year (31536000).

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH015

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH015