CODEWITHSUNDEEP
djangoencryptionsslhttps
brod
brod

Reputation: 99

Forcing https in Django

I'm trying to encrypt my entire site over SSL. However, I'm not finding a clear cut way to do this with Django 1.4. Does anyone know a solution?

Upvotes: 2

Views: 4092

Answers (2)

Chris Berry
Chris Berry

Reputation: 588

On apache+django (1.6) this can be done a number of ways but a simple way can be done in the .htaccess or httpd.conf file is:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URL}

Here's a link for further info on it:

http://wiki.apache.org/httpd/RewriteHTTPToHTTPS

To be sure the session and csrf cookies are not leaked by the client over plain http connections you should ensure that they are set as 'secure cookies' and only sent by the client over https. This can be done as follows in your settings.py file:

CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True

An intro to django security, including SSL/HTTPS (a must read):

https://docs.djangoproject.com/en/1.6/topics/security/

Upvotes: 3

Mark Lavin
Mark Lavin

Reputation: 25164

You could use a middleware such as those provided in django-secure or you could handle this at the Apache/Nginx/HAProxy level by redirecting all HTTP requests to HTTPS.

Upvotes: 6

Related Questions