v0.3.2: minor push

backend/config/settings.py

@@ -10,6 +10,10 @@ PROJECT_ROOT = BASE_DIR.parent
 
 SECRET_KEY = os.getenv("DJANGO_SECRET_KEY", "dev-only-change-before-production")
 DEBUG = os.getenv("DJANGO_DEBUG", "true").lower() == "true"
+USE_HTTPS = os.getenv(
+    "DJANGO_USE_HTTPS",
+    "false" if DEBUG else "true",
+).lower() == "true"
 if not DEBUG and SECRET_KEY == "dev-only-change-before-production":
     raise ImproperlyConfigured("生产环境必须设置 DJANGO_SECRET_KEY")
 ALLOWED_HOSTS = [
@@ -175,12 +179,14 @@ CSRF_COOKIE_SAMESITE = "Lax"
 SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
 SECURE_CONTENT_TYPE_NOSNIFF = True
 X_FRAME_OPTIONS = "DENY"
-SECURE_SSL_REDIRECT = not DEBUG
-SESSION_COOKIE_SECURE = not DEBUG
-CSRF_COOKIE_SECURE = not DEBUG
-SECURE_HSTS_SECONDS = int(os.getenv("SECURE_HSTS_SECONDS", "31536000" if not DEBUG else "0"))
-SECURE_HSTS_INCLUDE_SUBDOMAINS = not DEBUG
-SECURE_HSTS_PRELOAD = not DEBUG
+SECURE_SSL_REDIRECT = USE_HTTPS
+SESSION_COOKIE_SECURE = USE_HTTPS
+CSRF_COOKIE_SECURE = USE_HTTPS
+SECURE_HSTS_SECONDS = int(
+    os.getenv("SECURE_HSTS_SECONDS", "31536000" if USE_HTTPS else "0")
+)
+SECURE_HSTS_INCLUDE_SUBDOMAINS = USE_HTTPS
+SECURE_HSTS_PRELOAD = USE_HTTPS
 
 LOGGING = {
     "version": 1,