From 5807395d6fcce40f657a06aa3996377739294320 Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Wed, 28 Nov 2018 13:31:41 +0100
Subject: [PATCH] Added security settings to default configuration.

see #1592
---
 doc/upgrade.rst                                 | 7 +++++++
 modoboa/core/commands/templates/settings.py.tpl | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/doc/upgrade.rst b/doc/upgrade.rst
index a8eabe99b..e66228dc0 100644
--- a/doc/upgrade.rst
+++ b/doc/upgrade.rst
@@ -110,6 +110,13 @@ Add ``'modoboa.dnstools'`` to ``MODOBOA_APPS``:
       'modoboa.dnstools',
    )
 
+Add the following new settings:
+
+.. sourcecode:: python
+
+   CSRF_COOKIE_SECURE = True
+   SESSION_COOKIE_SECURE = True
+
 modoboa-postfix-autoreply 1.5.0
 ===============================
 
diff --git a/modoboa/core/commands/templates/settings.py.tpl b/modoboa/core/commands/templates/settings.py.tpl
index 0b16ce2ea..cfd0fc5b7 100644
--- a/modoboa/core/commands/templates/settings.py.tpl
+++ b/modoboa/core/commands/templates/settings.py.tpl
@@ -50,6 +50,8 @@ SITE_ID = 1
 # Security settings
 
 X_FRAME_OPTIONS = "SAMEORIGIN"
+CSRF_COOKIE_SECURE = True
+SESSION_COOKIE_SECURE = True
 
 # Application definition