Django / Nginx — Making SSL Work on Django Behind a Reverse Proxy & HTTP Only Apache

How to make SSL work on Django when the certification is done on the front-end server & apache is only listening on http.

I have nginx working as a reverse proxy for Apache / mod_python serving Django, somewhat according to the instructions here:

http://lethain.com/entry/2007/jul/17/dreamier-dream-server-nginx/

Basically, Nginx sits in the front, and forwards all requests but /media/ to apache.

My problem arose when I wanted to implement this SSL Redirect middleware: http://www.djangosnippets.org/snippets/880/

Last time I set up SSL on Django, I had nginx forward HTTPS requests to a separate apache virtual host, also listening on port 443. The SSL certification was on apache, so Djangos request.is_secure() returned True with no problems.

This time though, I have nginx dealing with the SSL, and forwarding the request to the same apache as regular http (one apache vhost), so apache is blissfully unaware of ssl. This means request.is_secure() always returns false, which means the SSLRedirect middleware endlessly loops around a redirect. Endlessly redirecting because is_secure() always returns False.

To fix the problem I just set up my nginx to add a header “HTTP_X_FORWARDED_PROTOCOL” = “https”

and replaced the request.is_secure() in our SSLRedirect middleware with a check to first see if the above mentioned header is in request.META, and then if its value is ‘https’. Return true if that is the case, and we successfully get a redirect.

I guess the value of it doesn’t matter, just that it exists vs not, but that feels very dirty.

Update:

You must edit the above mentioned snippet somewhere in the _is_secure(self, request): definition.

Add:

if 'HTTP_X_FORWARDED_PROTOCOL' in request.META:
return True


and edit nginx.conf (mine lives in /etc/nginx/nginx.conf):
Wherever you have your nginx listening on port 443, you know, something like server { listen 443; ...:

add a proxy_set_header X-Forwarded-Protocol https; to your configuration where you have your other headers set (right inside the location brackets).

Restart nginx and apache and you are good to go.