60

I have python/django app on Heroku (Cedar stack) and would like to make it accessible over https only. I have enabled the "ssl piggyback"-option, and can connect to it via https.

But what is the best way to disable http access, or redirect to https?

6 Answers 6

67

Combining the answer from @CraigKerstiens and @allanlei into something I have tested, and verified to work. Heroku sets the HTTP_X_FORWARDED_PROTO to https when request is ssl, and we can use this to check:

from django.conf import settings
from django.http import HttpResponseRedirect


class SSLMiddleware(object):

    def process_request(self, request):
        if not any([settings.DEBUG, request.is_secure(), request.META.get("HTTP_X_FORWARDED_PROTO", "") == 'https']):
            url = request.build_absolute_uri(request.get_full_path())
            secure_url = url.replace("http://", "https://")
            return HttpResponseRedirect(secure_url)
8
  • 1
    Upvote for putting on github... Thanks! Just what I was looking for today.
    – David S
    May 22, 2012 at 13:46
  • 4
    As a side note, this doesn't work if you have DEBUG set to True. Spent an hour figuring that one out, so hopefully this saves someone some time.
    – Femi
    Jul 8, 2012 at 18:13
  • 4
    In this case, remember to add this to settings to let django know requests are secure: SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
    – Bob Spryn
    Aug 19, 2012 at 23:44
  • 1
    It appears that you cannot serve static files with Django using that middleware. I still don't know why since I'm accessing it through https Mar 1, 2013 at 14:51
  • 1
    request.is_secure() already takes care of the HTTP_X_FORWARDED_PROTO header, you should not check for it again, see github.com/return1/django-sslify-admin/issues/1 . Currently, HTTP_X_FORWARDED_PROTO is always inspected. However; this header can be faked. As noted by the devs of django, you should be very explicit with such options: docs.djangoproject.com/en/dev/ref/settings/….
    – return1.at
    Jun 28, 2013 at 17:06
54

Django 1.8 will have core support for non-HTTPS redirect (integrated from django-secure):

SECURE_SSL_REDIRECT = True # [1]
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

In order for SECURE_SSL_REDIRECT to be handled you have to use the SecurityMiddleware:

MIDDLEWARE = [
    ...
    'django.middleware.security.SecurityMiddleware',
]

[1] https://docs.djangoproject.com/en/1.8/ref/settings/#secure-ssl-redirect

7
  • Does this mean the pip package sslify is obsolete as of Django 1.8?
    – dfrankow
    Aug 2, 2015 at 17:52
  • @dfrankow django-sslify sounds similar to django-secure, but you'll have to confirm that with the package author
    – shangxiao
    Aug 3, 2015 at 6:39
  • @dfrankow No, you still still need sslify with Django 1.8, if you want to automatically redirect users from http to https.
    – Ed J
    Dec 21, 2015 at 8:15
  • 11
    sslify's author confirms here that @dfrankow is correct, sslify is obsolete for Django >= 1.8
    – grrrrrr
    Apr 22, 2016 at 19:29
  • Set SECURE_SSL_REDIRECT=False for local server and True for production. This can be done by setting environment variable. os.environ.get("SECURE_SSL_REDIRECT")
    – Aseem
    Apr 1, 2019 at 6:09
13

Not sure if @CraigKerstiens's answer takes into account that request.is_secure() always returns False if behind Heroku's reverse proxy and not "fixed". If I remember correctly, this will cause a HTTP redirect loop.

If you are running Django with gunicorn, another way to do it is to add the following to gunicorn's config

secure_scheme_headers = {
    'X-FORWARDED-PROTO': 'https'
}

Run with some like this in your Procfile

web: python manage.py run_gunicorn -b 0.0.0.0:$PORT -c config/gunicorn.conf

By setting gunicorn's secure-scheme-header, request.is_secure() will properly return True on https requests. See Gunicorn Config.

Now @CraigKerstiens's middleware will work properly, including any calls to request.is_secure() in your app.

Note: Django also has the same config setting call SECURE_PROXY_SSL_HEADER, buts in the dev version.

2
  • 2
    The django SECURE_PROXY_SSL_HEADER setting is now available in mainline (certainly in 1.6, maybe earlier).
    – Symmetric
    Oct 31, 2014 at 4:02
  • Where do I put this? In what file?
    – Kovy Jacob
    Apr 2, 2021 at 15:23
6

What framework are you using for your application? If you're using Django you could simple use some middleware similar to:

import re

from django.conf import settings
from django.core import urlresolvers
from django.http import HttpResponse, HttpResponseRedirect


class SSLMiddleware(object):

    def process_request(self, request):
        if not any([settings.DEBUG, request.is_secure()]):
            url = request.build_absolute_uri(request.get_full_path())
            secure_url = url.replace("http://", "https://")
            return HttpResponseRedirect(secure_url)
2
  • Yes, I am using django. Thanks for the answer: I will give it a try unless something simpler (like a hidden heroku option) appears..
    – Kristian
    Dec 8, 2011 at 19:51
  • I had to make a small tweak to you answer, but the moderators rejected my edit. I have created my own answer which fixes the problem with never-ending redirects in your current answer. Thanks anyway, would never have thought of a middleware-solution without your contribution.
    – Kristian
    Feb 9, 2012 at 8:52
6

2020 update:

If you are using Flask, I would recommend the following:

@app.before_request
def before_request():
    if 'DYNO' in os.environ:
        if request.url.startswith('http://'):
            url = request.url.replace('http://', 'https://', 1)
            code = 301
            return redirect(url, code=code)

The above works excellent on Heroku and allows you to use http in local development with heroku local.

Flask-SSLify is no longer maintained and no longer officially supported by the Flask community.

2014 original answer:

If you're using Flask, this works quite well:

  1. Do "pip install flask-sslify"

(github is here: https://github.com/kennethreitz/flask-sslify)

  1. Include the following lines:
from flask_sslify import SSLify
if 'DYNO' in os.environ: # only trigger SSLify if the app is running 
on Heroku
    sslify = SSLify(app)
2
0

For Flask use Talisman. Flask, Heroku and SSLify documentations favor the use of Talisman over SSLify because the later is no longer maintained.

From SSLify:

The extension is no longer maintained, prefer using Flask-Talisman as it is encouraged by the Flask Security Guide.

Install via pip:

$ pip install flask-talisman

Instatiate the extension (example):

from flask import Flask
from flask_talisman import Talisman

app = Flask(__name__)
if 'DYNO' in os.environ:
    Talisman(app)

Talisman enables CSP (Content Security Policy) by default only allowing resources from the same domain to be loaded. If you want to disable it and deal with the implications:

Talisman(app, content_security_policy=None)

If you don't want to disable it you have to set the content_security_policy argument to allow resources from external domains, like CDNs, for instance. For that refer to the documentation.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.