comic · jmsmkn · Feb 18, 2025 · Feb 17, 2025
@@ -609,6 +609,7 @@ def get_private_ip():
     "grandchallenge.direct_messages",
     "grandchallenge.incentives",
     "grandchallenge.browser_sessions",
+    "grandchallenge.well_known",
 ]
 
 INSTALLED_APPS = DJANGO_APPS + LOCAL_APPS + THIRD_PARTY_APPS

@@ -1,6 +1,5 @@
 from django.conf import settings
 from django.urls import include, path
-from django.views.generic import TemplateView
 
 from grandchallenge.challenges.views import (
     ChallengeUpdate,
@@ -13,11 +12,7 @@
 
 urlpatterns = [
     path(
-        "robots.txt",
-        TemplateView.as_view(
-            template_name="robots.txt", content_type="text/plain"
-        ),
-        name="subdomain_robots_txt",
+        "", include("grandchallenge.well_known.urls", namespace="well-known")
     ),
     path(
         "evaluation/",

@@ -1,6 +1,5 @@
 from django.conf import settings
-from django.urls import path
-from django.views.generic import TemplateView
+from django.urls import include, path
 
 from grandchallenge.core.views import healthcheck
 from grandchallenge.serving.views import serve_images
@@ -11,10 +10,7 @@
 
 urlpatterns = [
     path(
-        "robots.txt",
-        TemplateView.as_view(
-            template_name="robots.txt", content_type="text/plain"
-        ),
+        "", include("grandchallenge.well_known.urls", namespace="well-known")
     ),
     path(
         "healthcheck/",

@@ -3,7 +3,7 @@
 from django.contrib.auth.decorators import login_required
 from django.contrib.sitemaps.views im
8000
port sitemap
 from django.urls import include, path
-from django.views.generic import RedirectView, TemplateView
+from django.views.generic import RedirectView
 from machina import urls as machina_urls
 
 from grandchallenge.algorithms.sitemaps import AlgorithmsSitemap
@@ -41,18 +41,15 @@
 }
 
 urlpatterns = [
+    path(
+        "", include("grandchallenge.well_known.urls", namespace="well-known")
+    ),
     path("", HomeTemplate.as_view(), name="home"),
     path(
         "challenge-suspended/",
         ChallengeSuspendedView.as_view(),
         name="challenge-suspended",
     ),
-    path(
-        "robots.txt",
-        TemplateView.as_view(
-            template_name="robots.txt", content_type="text/plain"
-        ),
-    ),
     path(
         "sitemap.xml",
         sitemap,

@@ -0,0 +1,5 @@
+Contact: mailto:security@{{ current_site.domain }}
+Contact: mailto:support@{{ current_site.domain }}
+Canonical: https://{{ current_site.domain }}/.well-known/security.txt
+Preferred-Languages: en, nl
+Expires: 2026-02-16T23:59:59z
@@ -0,0 +1,17 @@
+from django.urls import path
+from django.views.generic import TemplateView
+
+from grandchallenge.well_known.views import SecurityTXT
+
+app_name = "well_known"
+
+urlpatterns = [
+    path(
+        "robots.txt",
+        TemplateView.as_view(
+            template_name="well_known/robots.txt", content_type="text/plain"
+        ),
+        name="robots_txt",
+    ),
+    path(".well-known/security.txt", SecurityTXT.as_view()),
+]
@@ -0,0 +1,14 @@
+from django.contrib.sites.models import Site
+from django.views.generic import TemplateView
+
+
+class SecurityTXT(TemplateView):
+    template_name = "well_known/security.txt"
+    content_type = "text/plain"
+
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        context["current_site"] = Site.objects.get_current(
+            request=self.request
+        )
+        return context
@@ -376,7 +376,7 @@ def test_robots_txt_can_be_loaded(self):
         # main domain robots.txt
         robots_url = "/robots.txt"
         robots_url_project = reverse(
-            "subdomain_robots_txt",
+            "well_known:robots_txt",
             kwargs={"challenge_short_name": self.testchallenge.short_name},
         )
         self._test_url_can_be_viewed(None, robots_url)  # None = not logged in

@@ -0,0 +1,28 @@
+from datetime import timedelta
+
+import pytest
+from dateutil.parser import isoparse
+from django.utils.timezone import now
+
+
+@pytest.mark.django_db
+def test_security_txt_expiry_valid(client):
+    # If this test fails be sure to review the security.txt
+    # and update the expiry date
+    response = client.get("/.well-known/security.txt")
+
+    assert response.status_code == 200
+
+    lines = response.rendered_content.splitlines()
+
+    # Last line should contain the expiry clause
+    key, value = lines[-1].split(":", 1)
+
+    assert key == "Expires"
+
+    expiry_date = isoparse(value.strip())
+    expires_in = expiry_date - now()
+
+    # Must be more than a month and less than a year
+    # See https://www.rfc-editor.org/rfc/rfc9116#name-expires
+    assert timedelta(days=28) < expires_in < timedelta(days=365)
@@ -117,12 +117,6 @@ http {
     location / {
         rewrite ^ https://$host$request_uri? permanent;
     }
-
-    # for certbot challenges
-    location ~ /.well-known/acme-challenge {
-        allow all;
-        root /data/letsencrypt;
-    }
   }
 
   server {