feat: update security and configs

Author: michaelconan

.devcontainer/Dockerfile

@@ -427,7 +427,7 @@ daemon_umask = 0o077
 #
 # Variable: AIRFLOW__CORE__STRICT_DATASET_URI_VALIDATION
 #
-strict_dataset_uri_validation = False
+strict_dataset_uri_validation = True
 
 # (experimental) Whether components should use Airflow Internal API for DB connectivity.
 #
@@ -469,7 +469,7 @@ internal_api_secret_key = JWqQSd/jT7ohE3CoIVkxQA==
 #
 # Variable: AIRFLOW__CORE__TEST_CONNECTION
 #
-test_connection = Disabled
+test_connection = Enabled
 
 # The maximum length of the rendered template field. If the value to be stored in the
 # rendered template field exceeds this size, it's redacted.
@@ -1246,7 +1246,7 @@ enable_experimental_api = False
 #
 # Variable: AIRFLOW__API__AUTH_BACKENDS
 #
-auth_backends = airflow.api.auth.backend.basic_auth, airflow.api.auth.backend.session
+auth_backends = airflow.api.auth.backend.session
 
 # Used to set the maximum page limit for API requests. If limit passed as param
 # is greater than maximum page limit, it will be ignored and maximum page limit value
@@ -1710,13 +1710,13 @@ proxy_fix_x_prefix = 1
 #
 # Variable: AIRFLOW__WEBSERVER__COOKIE_SECURE
 #
-cookie_secure = False
+cookie_secure = True
 
 # Set samesite policy on session cookie
 #
 # Variable: AIRFLOW__WEBSERVER__COOKIE_SAMESITE
 #
-cookie_samesite = Lax
+cookie_samesite = Strict
 
 # Default setting for wrap toggle on DAG code and TI log views.
 #
@@ -1728,7 +1728,7 @@ default_wrap = False
 #
 # Variable: AIRFLOW__WEBSERVER__X_FRAME_ENABLED
 #
-x_frame_enabled = True
+x_frame_enabled = False
 
 # Send anonymous user activity to your analytics tool
 # choose from ``google_analytics``, ``segment``, ``metarouter``, or ``matomo``
@@ -1762,7 +1762,8 @@ show_recent_stats_for_completed_runs = True
 #
 # Variable: AIRFLOW__WEBSERVER__SESSION_LIFETIME_MINUTES
 #
-session_lifetime_minutes = 43200
+# 24 hours
+session_lifetime_minutes = 1440
 
 # Sets a custom page title for the DAGs overview page and site title for all pages
 #
@@ -1896,7 +1897,7 @@ email_conn_id = smtp_default
 #
 # Variable: AIRFLOW__EMAIL__DEFAULT_EMAIL_ON_RETRY
 #
-default_email_on_retry = True
+default_email_on_retry = False
 
 # Whether email alerts should be sent when a task failed
 #