tighten django security settings when DEBUG=False

[groovecoder]

I ran python manage.py check --deploy and fixed all of the warnings while DEBUG=False.

The SECURE_SSL_REDIRECT = True part was especially tricky to figure out. (https://github.com/mozilla-services/push-dev-dashboard/issues/149)

[openjck]

Nice! All of the relevant warnings go away on this branch.

I'm not able to test the site locally in production mode anymore, though. Is there an easy workaround for that, or do we want to forego testing in production mode for the time being?

[groovecoder]

Ah, because this now enforces HTTPS. I've done this on other projects with stunnel. If you want to give that a try, here are some docs from another project:

https://codesy.readthedocs.org/en/latest/development.html#run-locally-with-https

[openjck]

Stuck on one step. We can also do this as a follow-up if it's easier.

$ stunnel stunnel/dev_https
[ ] Clients allowed=2375
[ ] Cron thread initialized
[.] stunnel 5.31 on x86_64-apple-darwin15.3.0 platform
[.] Compiled/running with OpenSSL 1.0.2g  1 Mar 2016
[.] Threading:PTHREAD Sockets:POLL,IPv6 TLS:ENGINE,FIPS,OCSP,PSK,SNI
[ ] errno: (*__error())
[!] Invalid configuration file name "stunnel/dev_https"
[!] realpath: No such file or directory (2)

[groovecoder]

Yeah, sorry, you'll need to create that stunnel/ directory and copy the dev_https file from that other project into your local working copy. If you're willing to try that now go for it, but I'm also okay with filing a separate issue for it.

[groovecoder]

https://github.com/codesy/codesy/tree/master/stunnel

[openjck]

Instructions worked great. I'll submit a PR for adding them to this repo after this is merged.