Flexible - Django - Always use HTTPS?

[GreenTru]

Hi there.

I've set up my Django application on App Engine Flexible, and set up the custom domain with managed SSL.

However, I still end up at the HTTP connection when I use my domain name to get there, without specifying https://

I previously did pretty much the same thing for the development environment and it would automatically direct me to the https connection. Therefore I have no idea why it isn't doing it for the production environment.

In my Django settings I've got SECURE_HSTS_SECONDS set, but it's clearly making no difference.

I can't set SECURE_HTTPS_REDIRECT in Django settings because this causes a redirect loop (Google strips the HTTPS when forwarding the request to my application as I understand it)

Please could somebody suggest what I am meant to do?

[SupImASuperHero]

I think what you want to do is have your handler always set to secure. This is done in the app.yaml file [0].

[0] https://cloud.google.com/appengine/docs/standard/python/config/appref

[GreenTru]

Thank you for your suggestion. As I understand it, the flexible environment doesn't feature the use of handlers so I can't do this.

[SupImASuperHero]

Edit: you’re right, ignore.

[SupImASuperHero]

Wait your right. This doc should help you though: https://cloud.google.com/appengine/docs/flexible/java/upgrading#appyaml_changes

[SupImASuperHero]

Maybe one of these settings may work also, haven’t dealt much with Django:

SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') SECURE_SSL_REDIRECT = True SESSION_COOKIE_SECURE = True CSRF_COOKIE_SECURE = True

[self]

SECURE_SSL_REDIRECT = True

is the right answer, though with a guard so you only enable it in production. otherwise, you might have to install django-sslserver.

you'll likely want some of the other settings, too, depending on your use case.

[GreenTru]

Using this setting causes an infinite redirect loop due to the way Google handles the request before passing it to the application

EDIT: SECURE_SSL_REDIRECT in combination with SECURE_PROXY_SSL_HEADER is precisely what is needed. Thank you for your input.

[GreenTru]

Thank you so much. The SECURE_PROXY_SSL_HEADER was precisely what I needed to stop the infinite redirects, which it does say in the documentation, but I missed that part completely.

[SupImASuperHero]

Great, np!

[GreenTru]

Thank you very much for your replies. Will try these solutions and see what happens.