From 8825f6c63921c79f93db781b8a0fdab31456c618 Mon Sep 17 00:00:00 2001 From: Jacky Date: Tue, 29 Sep 2026 01:05:24 +0800 Subject: [PATCH] fix: decouple edge HSTS from backend health --- backend/common/test_deployment_security.py | 2 ++ scripts/deploy_production.sh | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/common/test_deployment_security.py b/backend/common/test_deployment_security.py index 93d822d..3f2a87f 100644 --- a/backend/common/test_deployment_security.py +++ b/backend/common/test_deployment_security.py @@ -13,5 +13,7 @@ def test_edge_hsts_ownership_is_explicit_and_verified(): assert '["security.W004"]' in settings assert "DJANGO_HSTS_AT_EDGE=true" in workflow assert 'DEPLOY_HEALTH_HOST="math.jacky0987.xyz"' in workflow + assert "curl --silent --show-error --head" in deploy + assert "curl --fail --silent --show-error --head" not in deploy assert "strict-transport-security:.*max-age=[1-9][0-9]*" in deploy assert "DJANGO_HSTS_AT_EDGE=false" in example diff --git a/scripts/deploy_production.sh b/scripts/deploy_production.sh index 0d2f19b..2f02a54 100755 --- a/scripts/deploy_production.sh +++ b/scripts/deploy_production.sh @@ -235,7 +235,7 @@ fi cd "$PROJECT_DIR/backend" if [ "${DJANGO_USE_HTTPS:-true}" = "true" ]; then if [ "${DJANGO_HSTS_AT_EDGE:-false}" = "true" ]; then - curl --fail --silent --show-error --head \ + curl --silent --show-error --head \ --noproxy '*' \ --resolve "${HEALTH_HOST}:443:127.0.0.1" \ --max-time 10 \ -- 2.54.0