title: How can you drop an HttpRequest connection in Django when TLS/SSL is not being used?
body: <p>I'm writing a Django 1.3 view method which requires TLS/SSL to be used. I want to entirely drop the connection if an HttpRequest is received without using TLS/SSL and NOT return any kind of response. This is for security reasons.</p>
  <p>Currently I am returning a response like so:</p>
  <pre><code>def some_view(request):
      if not request.is_secure():
          return HttpResponse(status=426)
      ...
  </code></pre>
  <p>However, returning <code>426 - Upgrade Required</code> poses a couple of problems:</p>
  <ol>
  <li>It's part of a proposed standard from May 2000 (<a href="https://www.rfc-editor.org/rfc/rfc2817#section-4.2" rel="nofollow noreferrer">RFC 2817</a>), and is not an official HTTP standard.</li>
  <li>The HttpResponse is open to a man-in-the-middle (MITM) attack. As <a href="https://stackoverflow.com/a/2556106/153040">mentioned in the comments here</a>, if the server returns any type of response to the client without a TLS/SSL connection first being established, a MITM could hijack the response, alter it to re-direct elsewhere, and deliver the malicious re-direct response to the client.</li>
  </ol>
  <p>Having the server re-direct from a HTTP URI to a HTTPS URI is open to the same MITM attack as noted above.</p>
  <p>So, how can you entirely drop a connection inside a Django 1.3 view method without returning any type of HttpResponse?</p>