Repository: cookiecutter/cookiecutter-django

Issue:
Having production only settings leads to deployment bugs
## Description
Move all security settings out of production.py and into base.py.

## Rationale
I have been bitten multiple times by security settings that are set only in production.py that I don't become aware of until deploying. If the setting is worth setting, it should be set in base.py, so that I can learn about clickjacking, CORS, HTTP only cookies, etc. when I'm still developing, rather than after I deploy and a feature is mysteriously broken. The only exception I can think of are secure cookies, and even that's only because it's a pain to get HTTPS working locally. (It still bit me when I was trying to "debug" my non-HTTPS staging site.)


Discussion:
Hi @carlmjohnson, I have a solution for your issue of running HTTPS locally
> The only exception I can think of are secure cookies, and even that's only because it's a pain to get HTTPS working locally.

This project comes with `django-extensions` installed, which supports running your app in HTTPS mode locally - autogenerating a cert.

You can achieve this by
```bash
pip install pyOpenSSL
python manage.py runserver_plus --cert local
```

Then adding the cert generated to your trusted certs in your web browser or use the appropriate option in `curl`, which is `--cacert </path/to/cert>` or `-k` to ignore checking the cert altogether.
@carlmjohnson let us know if you ever find time to submit a PR elaborating on the issue at hand -- we'll gradly review it.

Resolving patch:
diff --git a/{{cookiecutter.project_slug}}/config/settings/base.py b/{{cookiecutter.project_slug}}/config/settings/base.py
--- a/{{cookiecutter.project_slug}}/config/settings/base.py
+++ b/{{cookiecutter.project_slug}}/config/settings/base.py
@@ -209,6 +209,17 @@
     str(APPS_DIR.path('fixtures')),
 )
 
+# SECURITY
+# ------------------------------------------------------------------------------
+# https://docs.djangoproject.com/en/dev/ref/settings/#session-cookie-httponly
+SESSION_COOKIE_HTTPONLY = True
+# https://docs.djangoproject.com/en/dev/ref/settings/#csrf-cookie-httponly
+CSRF_COOKIE_HTTPONLY = True
+# https://docs.djangoproject.com/en/dev/ref/settings/#secure-browser-xss-filter
+SECURE_BROWSER_XSS_FILTER = True
+# https://docs.djangoproject.com/en/dev/ref/settings/#x-frame-options
+X_FRAME_OPTIONS = 'DENY'
+
 # EMAIL
 # ------------------------------------------------------------------------------
 # https://docs.djangoproject.com/en/dev/ref/settings/#email-backend
diff --git a/{{cookiecutter.project_slug}}/config/settings/production.py b/{{cookiecutter.project_slug}}/config/settings/production.py
--- a/{{cookiecutter.project_slug}}/config/settings/production.py
+++ b/{{cookiecutter.project_slug}}/config/settings/production.py
@@ -41,12 +41,8 @@
 SECURE_SSL_REDIRECT = env.bool('DJANGO_SECURE_SSL_REDIRECT', default=True)
 # https://docs.djangoproject.com/en/dev/ref/settings/#session-cookie-secure
 SESSION_COOKIE_SECURE = True
-# https://docs.djangoproject.com/en/dev/ref/settings/#session-cookie-httponly
-SESSION_COOKIE_HTTPONLY = True
 # https://docs.djangoproject.com/en/dev/ref/settings/#csrf-cookie-secure
 CSRF_COOKIE_SECURE = True
-# https://docs.djangoproject.com/en/dev/ref/settings/#csrf-cookie-httponly
-CSRF_COOKIE_HTTPONLY = True
 # https://docs.djangoproject.com/en/dev/topics/security/#ssl-https
 # https://docs.djangoproject.com/en/dev/ref/settings/#secure-hsts-seconds
 # TODO: set this to 60 seconds first and then to 518400 once you prove the former works
@@ -57,10 +53,6 @@
 SECURE_HSTS_PRELOAD = env.bool('DJANGO_SECURE_HSTS_PRELOAD', default=True)
 # https://docs.djangoproject.com/en/dev/ref/middleware/#x-content-type-options-nosniff
 SECURE_CONTENT_TYPE_NOSNIFF = env.bool('DJANGO_SECURE_CONTENT_TYPE_NOSNIFF', default=True)
-# https://docs.djangoproject.com/en/dev/ref/settings/#secure-browser-xss-filter
-SECURE_BROWSER_XSS_FILTER = True
-# https://docs.djangoproject.com/en/dev/ref/settings/#x-frame-options
-X_FRAME_OPTIONS = 'DENY'
 
 # STORAGES
 # ------------------------------------------------------------------------------


Test patch: