HSTS in Django: Set It Right Without Locking Yourself Out
HTTP Strict Transport Security, or HSTS, is one of those security headers that feels deceptively simple. Set one response header, ship it, done. Except that’s not really how it works in production. If you run a Django app and want HSTS configured properly, you need to understand what it actually does, how Django exposes it, and how to roll it out without accidentally breaking local development, subdomains, or a half-migrated environment. ...