[GH-ISSUE #1592] New warning message during modoboa upgrade #1253

New issue

Closed

opened 2026-02-27 11:16:07 +03:00 by kerem · 3 comments

kerem commented

2026-02-27 11:16:07 +03:00

Owner

Originally created by @stefaweb on GitHub (Oct 16, 2018).
Original GitHub issue: https://github.com/modoboa/modoboa/issues/1592

Hello!

During the upgrade to modoboa 1.11.1, contacts 0.7.2 and webmail 1.5.0, I got a new warning message.

(env) modoboa@mailhub:~/instance$ python manage.py check --deploy
System check identified some issues:

WARNINGS:
?: (security.W001) You do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_BROWSER_XSS_FILTER, and SECURE_SSL_REDIRECT settings will have no effect.
?: (security.W012) SESSION_COOKIE_SECURE is not set to True. Using a secure-only session cookie makes it more difficult for network traffic sniffers to hijack user sessions.
?: (security.W016) You have 'django.middleware.csrf.CsrfViewMiddleware' in your MIDDLEWARE, but you have not set CSRF_COOKIE_SECURE to True. Using a secure-only CSRF cookie makes it more difficult for network traffic sniffers to steal the CSRF token.

System check identified 3 issues (1 silenced).

Previous upgrade was not printing these messages.

Originally created by @stefaweb on GitHub (Oct 16, 2018). Original GitHub issue: https://github.com/modoboa/modoboa/issues/1592 Hello! During the upgrade to modoboa 1.11.1, contacts 0.7.2 and webmail 1.5.0, I got a new warning message. ``` (env) modoboa@mailhub:~/instance$ python manage.py check --deploy System check identified some issues: WARNINGS: ?: (security.W001) You do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_BROWSER_XSS_FILTER, and SECURE_SSL_REDIRECT settings will have no effect. ?: (security.W012) SESSION_COOKIE_SECURE is not set to True. Using a secure-only session cookie makes it more difficult for network traffic sniffers to hijack user sessions. ?: (security.W016) You have 'django.middleware.csrf.CsrfViewMiddleware' in your MIDDLEWARE, but you have not set CSRF_COOKIE_SECURE to True. Using a secure-only CSRF cookie makes it more difficult for network traffic sniffers to steal the CSRF token. System check identified 3 issues (1 silenced). ``` Previous upgrade was not printing these messages.

kerem

2026-02-27 11:16:07 +03:00

closed this issue
added the
enhancement
label

kerem commented

2026-02-27 11:16:08 +03:00

Author

Owner

@Tibase commented on GitHub (Oct 24, 2018):

Hello,

I have the same warnings messages after update from 1.10.6

@Tibase commented on GitHub (Oct 24, 2018): Hello, I have the same warnings messages after update from 1.10.6

kerem commented

2026-02-27 11:16:08 +03:00

Author

Owner

@Schokobecher commented on GitHub (Nov 27, 2018):

same here - 1.10. to 1.12.2

(env) modoboa@mail:~/instance$ python2 manage.py check --deploy
System check identified some issues:

WARNINGS:
?: (modoboa-amavis.W001) AMAVIS_DEFAULT_DATABASE_ENCODING does not match the character encoding used by the Amavis database.
HINT: Check your database character encoding and set/update AMAVIS_DEFAULT_DATABASE_ENCODING.
?: (security.W001) You do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_BROWSER_XSS_FILTER, and SECURE_SSL_REDIRECT settings will have no effect.
?: (security.W012) SESSION_COOKIE_SECURE is not set to True. Using a secure-only session cookie makes it more difficult for network traffic sniffers to hijack user sessions.
?: (security.W016) You have 'django.middleware.csrf.CsrfViewMiddleware' in your MIDDLEWARE, but you have not set CSRF_COOKIE_SECURE to True. Using a secure-only CSRF cookie makes it more difficult for network traffic sniffers to steal the CSRF token.

@Schokobecher commented on GitHub (Nov 27, 2018): same here - 1.10. to 1.12.2 > (env) modoboa@mail:~/instance$ python2 manage.py check --deploy > System check identified some issues: > > WARNINGS: > ?: (modoboa-amavis.W001) AMAVIS_DEFAULT_DATABASE_ENCODING does not match the character encoding used by the Amavis database. > HINT: Check your database character encoding and set/update AMAVIS_DEFAULT_DATABASE_ENCODING. > ?: (security.W001) You do not have 'django.middleware.security.SecurityMiddleware' in your MIDDLEWARE so the SECURE_HSTS_SECONDS, SECURE_CONTENT_TYPE_NOSNIFF, SECURE_BROWSER_XSS_FILTER, and SECURE_SSL_REDIRECT settings will have no effect. > ?: (security.W012) SESSION_COOKIE_SECURE is not set to True. Using a secure-only session cookie makes it more difficult for network traffic sniffers to hijack user sessions. > ?: (security.W016) You have 'django.middleware.csrf.CsrfViewMiddleware' in your MIDDLEWARE, but you have not set CSRF_COOKIE_SECURE to True. Using a secure-only CSRF cookie makes it more difficult for network traffic sniffers to steal the CSRF token.

kerem commented

2026-02-27 11:16:08 +03:00

Author

Owner

@tonioo commented on GitHub (Nov 28, 2018):

I've just pushed a fix for security.W012 and security.W016.
More information about security.W001 can be found here: https://docs.djangoproject.com/en/1.11/ref/middleware/#module-django.middleware.security.
@Schokobecher About modoboa-amavis.W001, you must adjust your configuration.

@tonioo commented on GitHub (Nov 28, 2018): I've just pushed a fix for security.W012 and security.W016. More information about security.W001 can be found here: https://docs.djangoproject.com/en/1.11/ref/middleware/#module-django.middleware.security. @Schokobecher About modoboa-amavis.W001, you must adjust your configuration.