Skip to main content

Django SSL/HTTPS

Introduction​

When building web applications, securing the data transmitted between users and your servers is crucial. This is where SSL (Secure Sockets Layer) and its successor, TLS (Transport Layer Security), come into play. Together with HTTPS (HTTP Secure), they form the backbone of web security.

In this guide, we'll explore how to implement SSL/HTTPS in your Django applications to ensure that all data transmitted between users and your application remains encrypted and secure from potential eavesdroppers and man-in-the-middle attacks.

What is SSL/HTTPS?​

SSL/TLS are cryptographic protocols that provide secure communication over a computer network. HTTPS is simply HTTP protocol running over SSL/TLS.

When your Django application uses HTTPS:

  • Data transmitted is encrypted, preventing eavesdropping
  • The identity of your server is verified, preventing impersonation
  • Data integrity is maintained, preventing tampering

Why Your Django Application Needs HTTPS​

Here are several compelling reasons to implement HTTPS:

  1. Security: Protects sensitive user data like passwords and personal information
  2. Trust: Browsers display security indicators for HTTPS sites
  3. SEO benefits: Google and other search engines prioritize secure sites
  4. Modern features: Many modern web features require HTTPS (geolocation, service workers, etc.)
  5. Regulatory compliance: Laws like GDPR and regulations often require secure data transmission

Configuring Django for HTTPS​

Let's explore how to configure your Django application to work properly with HTTPS:

Basic Settings in settings.py​

Add these settings to your settings.py file to enforce HTTPS:

python
# Security settings
SECURE_SSL_REDIRECT = True  # Redirects all non-HTTPS requests to HTTPS
SESSION_COOKIE_SECURE = True  # Only sends cookies over HTTPS
CSRF_COOKIE_SECURE = True  # Only sends CSRF token cookie over HTTPS
SECURE_HSTS_SECONDS = 31536000  # 1 year in seconds
SECURE_HSTS_INCLUDE_SUBDOMAINS = True  # Applies HSTS to all subdomains
SECURE_HSTS_PRELOAD = True  # Indicates the site should be included in browser HSTS preload lists
SECURE_REFERRER_POLICY = 'same-origin'
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')  # Needed behind reverse proxies

Let's explain each of these settings:

  • SECURE_SSL_REDIRECT: Redirects all HTTP requests to HTTPS
  • SESSION_COOKIE_SECURE: Ensures session cookies are only sent over HTTPS
  • CSRF_COOKIE_SECURE: Ensures CSRF cookies are only sent over HTTPS
  • SECURE_HSTS_SECONDS: Enables HTTP Strict Transport Security (HSTS) which tells browsers to always use HTTPS
  • SECURE_HSTS_INCLUDE_SUBDOMAINS: Applies HSTS to all subdomains
  • SECURE_HSTS_PRELOAD: Allows inclusion in browser HSTS preload lists
  • SECURE_REFERRER_POLICY: Controls what information is included in the Referer header
  • SECURE_PROXY_SSL_HEADER: Helps Django determine if the request is secure when behind a proxy

Development vs Production Settings​

You should typically only enable these settings in production. For development, you might want to keep them disabled:

python
if not DEBUG:  # Production environment
    SECURE_SSL_REDIRECT = True
    SESSION_COOKIE_SECURE = True
    CSRF_COOKIE_SECURE = True
    # Other security settings...
else:  # Development environment
    SECURE_SSL_REDIRECT = False
    SESSION_COOKIE_SECURE = False
    CSRF_COOKIE_SECURE = False

Obtaining SSL Certificates​

To enable HTTPS, you need an SSL certificate. Here are common ways to obtain one:

Let's Encrypt (Free)​

Let's Encrypt offers free SSL certificates that are widely accepted. You can use Certbot to automate the process:

bash
# Install Certbot (Ubuntu example)
sudo apt-get update
sudo apt-get install certbot python3-certbot-nginx  # for Nginx
sudo apt-get install certbot python3-certbot-apache  # for Apache

# Request a certificate for Nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

# Request a certificate for Apache
sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Commercial Certificates​

For commercial applications or those requiring extended validation, you might consider purchasing certificates from providers like:

  • Comodo SSL
  • DigiCert
  • GlobalSign
  • Sectigo

Self-signed Certificates (Development Only)​

For development purposes, you can create self-signed certificates:

bash
# Generate a private key
openssl genrsa -out server.key 2048

# Generate a certificate signing request
openssl req -new -key server.key -out server.csr

# Generate a self-signed certificate valid for 365 days
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

⚠️ Warning: Never use self-signed certificates in production environments.

Configuring Web Servers for HTTPS​

Nginx Configuration​

Here's a basic Nginx configuration for serving Django with HTTPS:

nginx
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;  # Redirect all HTTP to HTTPS
}

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;
    
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    
    # SSL parameters
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256';
    
    # Other security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options nosniff;
    add_header X-Frame-Options DENY;
    add_header X-XSS-Protection "1; mode=block";
    
    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_pass http://localhost:8000;  # Assuming Django runs on port 8000
    }
}

Apache Configuration​

For Apache with mod_ssl:

apache
<VirtualHost *:80>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com
    Redirect permanent / https://yourdomain.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com
    
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem
    
    # Other security headers
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Frame-Options DENY
    Header always set X-XSS-Protection "1; mode=block"
    
    ProxyPass / http://localhost:8000/
    ProxyPassReverse / http://localhost:8000/
    ProxyPreserveHost On
    RequestHeader set X-Forwarded-Proto "https"
</VirtualHost>

Running Django with SSL in Development​

For development purposes, you might want to run Django's development server with SSL:

Using Django's runserver_plus (Django Extensions)​

Django Extensions provides a convenient way to run the development server with SSL:

  1. Install Django Extensions:
bash
pip install django-extensions werkzeug pyOpenSSL
  1. Add it to your INSTALLED_APPS:
python
INSTALLED_APPS = [
    # ...
    'django_extensions',
    # ...
]
  1. Run the server with SSL:
bash
python manage.py runserver_plus --cert-file /path/to/cert.crt

Using Django's Built-in Server with SSL​

For a simpler approach without additional packages:

  1. Create a self-signed certificate as shown earlier
  2. Run the server with SSL using Python's built-in SSL module:
python
# ssl_server.py
import os
import ssl
from django.core.management.commands.runserver import Command as RunserverCommand

class Command(RunserverCommand):
    def handle(self, *args, **options):
        # Add SSL context
        certfile = os.path.join('path', 'to', 'server.crt')
        keyfile = os.path.join('path', 'to', 'server.key')
        
        options['addrport'] = '0.0.0.0:8000'  # Change port as needed
        options['use_ssl'] = True
        options['ssl_certfile'] = certfile
        options['ssl_keyfile'] = keyfile
        
        super().handle(*args, **options)

# Run this module directly
if __name__ == '__main__':
    import os
    import sys
    
    # Setup environment
    os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'yourproject.settings')
    
    # Import Django
    import django
    django.setup()
    
    # Run command
    command = Command()
    command.run_from_argv(['manage.py', 'runserver', '--noreload'])

Run with:

bash
python ssl_server.py

Handling Mixed Content Warnings​

When transitioning your site to HTTPS, you might encounter mixed content warnings. These happen when your HTTPS page includes resources (like images, scripts, or stylesheets) over HTTP.

Using Relative URLs​

Use relative URLs for resources when possible:

html
<!-- Bad: absolute URL with HTTP -->
<img src="http://yourdomain.com/images/logo.png">

<!-- Good: relative URL -->
<img src="/images/logo.png">

Forcing HTTPS in Templates​

For external resources, make sure to use HTTPS:

html
<!-- Before -->
<script src="http://external-cdn.com/script.js"></script>

<!-- After -->
<script src="https://external-cdn.com/script.js"></script>

Using Django's Template Settings​

Django provides a way to specify the URL scheme in templates:

python
# settings.py
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
USE_X_FORWARDED_HOST = True

Then in your templates, you can use request.is_secure() to check if the connection is secure:

html
{% if request.is_secure %}
  <!-- HTTPS content -->
{% else %}
  <!-- HTTP content (or redirect) -->
{% endif %}

Testing Your HTTPS Configuration​

After you've set up HTTPS, it's important to test your configuration:

Online SSL Testing Tools​

Use these online tools to test your SSL configuration:

Django's Security Check​

Django includes a check command to verify your security settings:

bash
python manage.py check --deploy

This will provide recommendations for security-related settings.

Real-world Example: Secure User Authentication​

Let's look at a complete example of a secure login view that requires HTTPS:

python
# views.py
from django.contrib.auth import authenticate, login
from django.contrib.auth.forms import AuthenticationForm
from django.shortcuts import render, redirect
from django.views.decorators.https import require_https

@require_https
def secure_login(request):
    """A secure login view that requires HTTPS."""
    if request.method == 'POST':
        form = AuthenticationForm(request, data=request.POST)
        if form.is_valid():
            username = form.cleaned_data.get('username')
            password = form.cleaned_data.get('password')
            user = authenticate(username=username, password=password)
            if user is not None:
                login(request, user)
                return redirect('dashboard')
    else:
        form = AuthenticationForm()
    
    return render(request, 'login.html', {'form': form})

In your urls.py:

python
from django.urls import path
from . import views

urlpatterns = [
    path('login/', views.secure_login, name='login'),
    # Other URL patterns
]

The @require_https decorator ensures this view can only be accessed via HTTPS. If someone tries to access it via HTTP, Django will redirect them to the HTTPS version of the URL.

Common Issues and Solutions​

Certificate Issues​

Issue: Browser warnings about invalid certificates Solution: Ensure your certificate is valid, not expired, and issued to the correct domain.

Mixed Content Warnings​

Issue: Browser blocking mixed content Solution: Update all resources to use HTTPS and implement a Content-Security-Policy.

Performance Concerns​

Issue: HTTPS slowing down your site Solution: Implement HTTP/2, use SSL session caching, and consider a CDN.

Proxy Issues​

Issue: HTTPS not detected behind a proxy Solution: Properly configure SECURE_PROXY_SSL_HEADER and ensure your proxy sets the correct headers.

Summary​

Implementing SSL/HTTPS in your Django application is not only a security best practice but also increasingly necessary for modern web applications. By following the steps outlined in this guide, you can ensure that:

  1. All data transmitted between users and your application is encrypted
  2. Your application properly redirects HTTP requests to HTTPS
  3. Your cookies and sessions are secure
  4. Your web server is configured optimally for HTTPS

Remember that security is an ongoing process, and it's important to regularly audit and update your security configurations as new best practices and vulnerabilities emerge.

Additional Resources​

Exercises​

  1. Set up a development Django server with a self-signed SSL certificate
  2. Configure a production-ready Nginx or Apache configuration with Let's Encrypt
  3. Use Django's check --deploy command to identify and fix security issues
  4. Implement a content security policy that prevents mixed content
  5. Create a middleware that adds security headers to all responses

By implementing HTTPS in your Django application, you're taking a significant step toward providing a secure experience for your users and protecting their data from potential threats.


If you spot any mistakes on this website, please let me know at [email protected]. I’d greatly appreciate your feedback! :)