Merge ~suligap/canonical-identity-provider:drop-djangosecure into canonical-identity-provider:master

[Przemysław Suliga]

Drop deprecated django-secure dependency

djangosecure was mostly swallowed by Django in 1.8:
https://docs.djangoproject.com/en/1.8/releases/1.8/#security-enhancements

And switch to django.middleware.security.SecurityMiddleware.

This has the additional benefit of no longer depending on a middleware class
that is not compatible with Django's "new style" MIDDLEWARE:
https://docs.djangoproject.com/en/1.11/topics/http/middleware/#upgrading-middleware

Functionally nothing changes with the djangosecure settings we use:

- `SECURE_BROWSER_XSS_FILTER = True` adds the
  `x-xss-protection: 1; mode=block` response header

- `SECURE_CONTENT_TYPE_NOSNIFF = True` adds the
  `x-content-type-options: nosniff` response header

- SECURE_HSTS_SECONDS and SECURE_HSTS_INCLUDE_SUBDOMAINS are also supported. As
  a side note: It looks like for SSO, HSTS might be configured in its reverse
  proxies, since the max-age values differ between what's being server by
  login.ubuntu.com and the value that exists in SSO's django settings. Also,
  SECURE_HSTS_PRELOAD is not configured in SSO's django settings but `preload`
  exists in responses from login.ubuntu.com.

- SECURE_SSL_REDIRECT (set to None currently) is also supported

- SECURE_FRAME_DENY is being dropped in this change as the behavior is already
  being overriden by Django's XFrameOptionsMiddleware configured in SSO.
  Functionally nothing changes and `X-Frame-Options: SAMEORIGIN` header is being
  added to responses`. This setting was set to None and it does not exist
  outside of djangosecure's middleware.

This change also puts the SecurityMiddleware first in the middleware's list.

[Daniel Manrique (roadmr)]

Brilliant :)

review: Approve

[Otto Co-Pilot (otto-copilot)]

Running landing tests failed
https://jenkins.ols.canonical.com/online-services/job/canonical-identity-provider/338/

57f14a9... by Przemysław Suliga on 2020-05-26

Remove djangosecure from INSTALLED_APPS

diff --git a/django_project/settings_base.py b/django_project/settings_base.py
index 561acbf..512b4d6 100644
--- a/django_project/settings_base.py
+++ b/django_project/settings_base.py
@@ -207,7 +207,6 @@ INSTALLED_APPS = [
     'adminaudit',
     'django_openid_auth',
     'django_statsd',
-    'djangosecure',
     'gargoyle',
     'honeypot',
     'oauth_backend',
@@ -386,6 +385,7 @@ MEDIA_ROOT = ''
 MEDIA_URL = ''
 MESSAGE_STORAGE = 'django.contrib.messages.storage.fallback.FallbackStorage'
 MIDDLEWARE_CLASSES = [
+    'django.middleware.security.SecurityMiddleware',
     ('raven.contrib.django.raven_compat.middleware'
      '.SentryResponseErrorIdMiddleware'),
     'api.v20.utils.EnsureJSONResponseOnAPIErrorMiddleware',
@@ -394,7 +394,6 @@ MIDDLEWARE_CLASSES = [
     'django_statsd.middleware.GraphiteMiddleware',
     'identityprovider.middleware.readonly.ReadOnlyMiddleware',
     'identityprovider.middleware.oopsplease.OopsPleaseMiddleware',
-    'djangosecure.middleware.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
     'django.middleware.common.CommonMiddleware',
     'identityprovider.middleware.honeypot.HoneypotMiddleware',
@@ -490,7 +489,6 @@ SAML_NOT_AFTER_MINUTES = 15
 SECRET_KEY = ''
 SECURE_BROWSER_XSS_FILTER = True
 SECURE_CONTENT_TYPE_NOSNIFF = True
-SECURE_FRAME_DENY = False
 SECURE_HSTS_INCLUDE_SUBDOMAINS = True
 SECURE_HSTS_SECONDS = 15552000
 SECURE_PROXY_SSL_HEADER = None
diff --git a/requirements.txt b/requirements.txt
index 0577502..8c192ec 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -12,7 +12,6 @@ django-openid-auth==0.14
 django-pgtools==0.4.2
 django-piston==0.2.4
 django-preflight==0.2.0
-django-secure==1.0.1
 django-statsd-mozilla==0.4.0
 enum34==1.1.6
 gargoyle-yplan==1.2.5