# Quick start

## Default configuration

To apply default security headers to all responses:

1. Install from `pip`

       pip install django-security-headers

2. Add the `csp` and `security_headers` middleware

       MIDDLEWARES = [
         "django.middleware.security.SecurityMiddleware",
         "csp.middleware.CSPMiddleware",
         "security_headers.middleware.extra_security_headers",
          ...
       ]

3. Add the default `csp` and `security_headers` settings by importing the defaults to your local `settings.py`

       from security_headers.defaults import *

## Optional configuration

To permit framing from whitelisted domains, add `security_headers` to your `INSTALLED_APPS`.

    INSTALLED_APPS = [
      ...
      "security_headers",
      ...
    ]

This will expose a simple admin interface for specifying safe domains. To access template tags provided by `django-csp`, install `csp` as well

    INSTALLED_APPS = [
      ...
      "security_headers",
      "csp",
      ...
    ]

## Development settings

During development using http localhost server, you will need to overwrite some default settings that require SSL. At the very end of your `settings.py` file, include

    CSRF_COOKIE_SECURE = not DEBUG
    SECURE_SSL_REDIRECT = not DEBUG
    SESSION_COOKIE_SECURE = not DEBUG
    SECURE_HSTS_SECONDS = 3600

Reducing `SECURE_HSTS_SECONDS` time is also a good idea during development.