- This project was merged into Django 1.8 and its features are now part of core Django. Thus it is unmaintained and you should not use it.
- Hide django-secure tests from pre-1.6 Django test runners, to avoid breaking project tests.
- BACKWARDS INCOMPATIBLE: Dropped tested support for Python 2.5, Django 1.2, and Django 1.3.
- Added support and testing for Python 3 (though all non-test code worked fine under Python 3 previously.)
- Added check for
SECRET_KEY
. Thanks Ram Rachum.
- Added the
SECURE_HSTS_INCLUDE_SUBDOMAINS
setting. Thanks Paul McMillan for the report and Donald Stufft for the patch. Fixes #13. - Added the
X-XSS-Protection: 1; mode=block
header. Thanks Johannas Heller.
- Added the
X-Content-Type-Options: nosniff
header. Thanks Johannas Heller. SECURE_PROXY_SSL_HEADER
setting now patchesrequest.is_secure()
so it respects proxied SSL, to avoid redirects to http that should be to https.
- Initial release.