10

I am running my Django application in Cloud9 for development purposes using the usual ./manage.py runserver. But to the outside world, the app is accessible via a https:// URL.

The problem is that when I use the URL reverse function, the URLs that come back start with http:// (at least some of the time). When I try redirecting to one of those URLs, I get an error like this one in the console:

Mixed Content: The page at 'https://apps.facebook.com/xxxx/' 
was loaded over HTTPS, but requested an insecure form action 
'http://xxxx.c9users.io/facebook_app/gift_shop/'. 
This request has been blocked; the content must be served over HTTPS.

My question: is there a way to force reverse to generate HTTPS URLs instead of HTTP?

Here is a snippet of code, which has problems with redirection from HTTPS URLs to HTTP ones:

class IndexRedirectView(RedirectView, CSRFExemptMixin):
    permanent = False

    def get_redirect_url(self, *args, **kwargs):
        if self.request.user.visit_count >= 5:
            return reverse('gift-shop')
        if len(BaseGiftableInstance.objects.filter(giving_user=self.request.user)) > 0:
            # has won something
            return reverse('gift-shop')
        return reverse('spinner')
5
  • 10
    YOU MUST NOT RUN YOUR PRODUCTION SITE WITH RUNSERVER. Feb 4, 2016 at 12:40
  • @DanielRoseman This is not my production site. Feb 4, 2016 at 12:41
  • 4
    It's publicly accessible though. Don't do this. Configure a proper webserver. Feb 4, 2016 at 12:41
  • I still need debugging features to ease the development. And I am using Cloud9, so Facebook can have access to the application. Feb 4, 2016 at 12:43
  • 2
    @DanielRoseman Cloud9 is a cloud based IDE. Chill out.
    – user764357
    Sep 8, 2016 at 21:42

2 Answers 2

9

If you are on Django 1.8 or greater, you can force SSL with the setting SECURE_SSL_REDIRECT = True - see this answer on a similar question

7

You should check out django-sslify, you just install it and add it to your MIDDLEWARE_CLASSES.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.