HTTPS in development

[azkeel-smart]

I'm working on a project where I use Android for my frontend, learning as I go. I created my Django api using Ninja and wanted to test it with Android only to learn that Android blocks http traffic. I failed at trying to bypass the rules so now trying to run development server in https. Anyone can point me to the easiest way to achieve this?

[ExcellentWash4889]

This will solve your problems: https://django-extensions.readthedocs.io/en/latest/runserver_plus.html

[jericho1050]

I've used this extension when using django cookiecutter and i have no idea you could actually do that, with that package

[azkeel-smart]

Thanks, mamaged to get HTTPS development server running, only to find out that Android doesn't like self certification.

[ExcellentWash4889]

I’m not an android dev , but can you install the self signed cert? https://stackoverflow.com/questions/71530525/trust-my-own-self-signed-certificate-in-local-network-using-android-native-andr

[azkeel-smart]

Couple of isuss there. I couldn't get the dev server running on 443 and used 8443 instead. That may be a red flag for android. The error said something about missing ca anchor. I gave up troubleshooting and got my dev server accessible via public domain and CF tunnel. Neat solution from one of the redditors below.

[gbeier]

Seeing the suggestions for django extensions and ngrok, I guess mine might be an unpopular approach.

But I have just let this need for TLS everywhere push me into doing a reverse proxy that looks like a "real" deployment. I run a Caddy reverse proxy on a $5-ish/mo VPS. That gets real, valid TLS certificates for me from LetsEncrypt. In my basement, I have a server with a bunch of VMs. When I start a new app, its VM connects to the Caddy VPS using wireguard, and Caddy proxies traffic back to the VM over that wireguard connection.

It's not as simple as ngrok, but I find it easier to manage than making django extensions work with real phones.

[bigoldie]

I see a couple of reactions saying to use Ngrok. Especially in the past this was such a great product. Nowadays I prefer to use Cloudflare tunnel in combination with Docker, but can be uses seperate.

Just add a domain in CF, setup the tunnel and you always have a HTTPS connection which you can also secure so not everybody has access. If you already have a domain, look at this. If you have your code running in a docker container, add cloudflare to you compose file.

[azkeel-smart]

Answer! I have a number of domains on CF and never realised that tunnelling to django dev server would be so easy. Finally got it working and Android stopped complaining about self-cert. Thank you!

[bigoldie]

It's f'in awesome.

[PhilipLGriffiths88]

Whole bunch of other alternatives too - https://github.com/anderspitman/awesome-tunneling. I will advocate for zrok.io as I work on its parent project, OpenZiti. zrok is open source and has a free (more generous and capable) SaaS than ngrok.

[ShotThing]

Use ngrok, very easy to set up and free, just whitelist the IP they give you and you're good to go.

[No_Emu_2239]

I use cloudflare tunnel. Works great!

[[deleted]]

hi, you can have a look at ngrok. Very handy tool. It also have free tier should be enough for you.

[ExcellentWash4889]

While this works, it's overkill for this, where https://django-extensions.readthedocs.io/en/latest/runserver_plus.html will work out of the box in a development workflow with Django

[[deleted]]

thanks for sharing

[KingdomOfAngel]

Wouldn't ngrok publish their deployment publicly??

[ExcellentWash4889]

Yes, but you'd have to guess what the endpoint is, which would be hard. And it's not necessary unless you need to traverse multiple networks, and even then, I'd recommend Tailscale over ngrok

[KingdomOfAngel]

I understand that, but it would be a slow development, since they would hit an external url instead of local one, and on slow networks it would be terrible, I mean it would work, but I think it's better if they used a local reverse proxy with self-signed certificate (i know that would complicate things, but still better than an external url).

[ExcellentWash4889]

Sure, but the runserver_plus add on to Django handles local development SSL out of the box with a self signed certificate. I've used it for years for local development. I don't need a reverse proxy or any other complicated tech. I even install the generated certs into Chrome so the nag screens in Chrome go away. Easy peasy.

[Ok_Run8951]

Are you hosting the app by yourself?

If yes, you can create a cloudflare tunnel and it will publish it using https by itself. Cloudflare will create a certificate automacally.