fix: verify edge-owned HSTS during deployment

2026-09-29 00:40:00 +08:00
parent 136db1d47e
commit 6d8ed567b0
5 changed files with 35 additions and 0 deletions
@@ -17,6 +17,8 @@ API_ANON_RATE=120/minute
 API_USER_RATE=600/minute
 CALCULATOR_RATE=30/minute
 SECURE_HSTS_SECONDS=31536000
+# Set true only when the HTTPS reverse proxy emits a non-zero HSTS max-age.
+DJANGO_HSTS_AT_EDGE=false

 # 仅供部署脚本直接访问 127.0.0.1:8000 时设置 Host 头。
 DEPLOY_HEALTH_HOST=math.example.com