p31829507
/
django
mirror of https://github.com/django/django.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Two additions to the deployment checklist. 

Thanks Erik Romijn.
This commit is contained in:
Aymeric Augustin 2013-03-17 19:29:22 +01:00
parent 912b5d2a6b
commit c94db53eaa
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/howto/deployment/checklist.txt
View File

@ -93,6 +93,9 @@ connections from your application servers.
Database connection parameters are probably different in development and in
production.
Database passwords are very sensitive. You should protect them exactly like
:setting:`SECRET_KEY`.
For maximum security, make sure database servers only accept connections from
your application servers.
@ -130,7 +133,9 @@ the login/password, the session cookie, and password reset tokens. (You can't
do much to protect password reset tokens if you're sending them by email.)
Protecting sensitive areas such as the user account or the admin isn't
sufficient, because the same session cookie is used for HTTP and HTTPS.
sufficient, because the same session cookie is used for HTTP and HTTPS. Your
web server must redirect all HTTP traffic to HTTPS, and only transmit HTTPS
requests to Django.
Once you've set up HTTPS, enable the following settings.