security: harden production settings for GraphQL, HSTS, and HTTP headers (fixes #3783)

backend/settings/base.py

@@ -229,3 +229,5 @@ class Base(Configuration):
     SLACK_COMMANDS_ENABLED = True
     SLACK_EVENTS_ENABLED = True
     SLACK_SIGNING_SECRET = values.SecretValue()
+
+    SECURE_CONTENT_TYPE_NOSNIFF = True

backend/settings/graphql.py

@@ -1,7 +1,9 @@
 """GraphQL schema."""
 
 import strawberry
+from django.conf import settings
 from strawberry.extensions import QueryDepthLimiter
+from strawberry.schema.config import StrawberryConfig
 from strawberry_django.optimizer import DjangoOptimizerExtension
 
 from apps.api.internal.mutations import ApiMutations
@@ -46,4 +48,8 @@ class Query(
     mutation=Mutation,
     query=Query,
     extensions=[QueryDepthLimiter(max_depth=5), DjangoOptimizerExtension()],
+    config=StrawberryConfig(
+        enable_introspection=settings.DEBUG
+        or getattr(settings, "IS_FUZZ_ENVIRONMENT", False)
+    ),
 )

backend/settings/production.py

@@ -54,3 +54,10 @@ class Production(Base):
 
     SLACK_COMMANDS_ENABLED = True
     SLACK_EVENTS_ENABLED = True
+
+    # Security
+    SECURE_HSTS_SECONDS = 31536000
+    SECURE_HSTS_INCLUDE_SUBDOMAINS = True
+    SECURE_HSTS_PRELOAD = True
+    SECURE_SSL_REDIRECT = True
+    SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")