1389194 - Remove django-csp and extra security header stuff

Status: RESOLVED FIXED

Description

[Peter Bengtsson [:peterbe]]

With https://bugzilla.mozilla.org/show_bug.cgi?id=1388808 we're making sure we set all the security related headers in Nginx instead of relying on Django. 

Then we don't need to do that stuff with Django.

Comment 1

[Peter Bengtsson [:peterbe]]

PR https://github.com/mozilla-services/tecken/pull/313

Comment 2

[[github robot]]

Commit pushed to master at https://github.com/mozilla-services/tecken

https://github.com/mozilla-services/tecken/commit/49fd396a433fa9e44fccfd96d4d0f987d3b57c93
fixes bug 1389194 - Remove django-csp and extra security header stuff (#313)

Comment 3

[Peter Bengtsson [:peterbe]]

This "broken" __heartbeat__ since you now get a warning::

 "check_xframe_options_middleware": {
   "status": "warning",
   "level": 30,
   "messages": {
     "security.W002": "You do not have 'django.middleware.clickjacking.XFrameOptionsMiddleware' in your MIDDLEWARE_CLASSES, so your pages will not be served with an 'x-frame-options' header. Unless there is a good reason for your site to be served in a frame, you should consider enabling this header to help prevent clickjacking attacks."
   }
 }

Comment 4

[Peter Bengtsson [:peterbe]]

PR https://github.com/mozilla-services/tecken/pull/317

Comment 5

[[github robot]]

Commit pushed to master at https://github.com/mozilla-services/tecken

https://github.com/mozilla-services/tecken/commit/b6fb0f3e42bbe94db5c72f99ddf93897f7f84bd9
bug 1389194 - silence dockerflow warning about xframe options (#317)

Comment 6

[Peter Bengtsson [:peterbe]]

By the way, the heartbeat URL is https://symbols.dev.mozaws.net/__heartbeat__

Comment 7

[Peter Bengtsson [:peterbe]]

Heartbeat is healthy now.