Jacky/Hulumath-Web
2
2
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Merge pull request 'fix: decouple edge HSTS from backend health' (#44) from fix/edge-hsts-header-probe into main

Browse Source
This commit was merged in pull request #44.
This commit is contained in:
Jacky
2026-09-29 01:13:59 +08:00
parent d87edf0530 8825f6c639
commit 9a5ce6e4af
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/common/test_deployment_security.py
+2
View File
@@ -13,5 +13,7 @@ def test_edge_hsts_ownership_is_explicit_and_verified():
assert '["security.W004"]' in settings assert '["security.W004"]' in settings
assert "DJANGO_HSTS_AT_EDGE=true" in workflow assert "DJANGO_HSTS_AT_EDGE=true" in workflow
assert 'DEPLOY_HEALTH_HOST="math.jacky0987.xyz"' in workflow assert 'DEPLOY_HEALTH_HOST="math.jacky0987.xyz"' in workflow
assert "curl --silent --show-error --head" in deploy
assert "curl --fail --silent --show-error --head" not in deploy
assert "strict-transport-security:.*max-age=[1-9][0-9]*" in deploy assert "strict-transport-security:.*max-age=[1-9][0-9]*" in deploy
assert "DJANGO_HSTS_AT_EDGE=false" in example assert "DJANGO_HSTS_AT_EDGE=false" in example
scripts/deploy_production.sh
+1 -1
View File
@@ -235,7 +235,7 @@ fi
cd "$PROJECT_DIR/backend" cd "$PROJECT_DIR/backend"
if [ "${DJANGO_USE_HTTPS:-true}" = "true" ]; then if [ "${DJANGO_USE_HTTPS:-true}" = "true" ]; then
if [ "${DJANGO_HSTS_AT_EDGE:-false}" = "true" ]; then if [ "${DJANGO_HSTS_AT_EDGE:-false}" = "true" ]; then
curl --fail --silent --show-error --head \ curl --silent --show-error --head \
--noproxy '*' \ --noproxy '*' \
--resolve "${HEALTH_HOST}:443:127.0.0.1" \ --resolve "${HEALTH_HOST}:443:127.0.0.1" \
--max-time 10 \ --max-time 10 \