title: How to deploy an HTTPS-only site, with Django/nginx?
body: <p>My original question was how to <a href="https://stackoverflow.com/questions/8015685/how-to-enable-https-in-django-auth-generated-pages">enable HTTPS for a Django login page</a>, and the only response, recommended that I - <em>make the entire site as HTTPS-only</em>.</p>
  
  <p>Given that I'm using Django 1.3 and nginx, what's the correct way to make a site HTTPS-only? </p>
  
  <p>The one response mentioned <a href="https://stackoverflow.com/questions/2799450/django-https-for-just-login-page">a middleware solution</a>, but had the caveat:</p>
  
  <blockquote>
    <p>Django can't perform a SSL redirect while maintaining POST data.
    Please structure your views so that redirects only occur during GETs.</p>
  </blockquote>
  
  <p>A question on Server Fault about <a href="https://serverfault.com/questions/330729/front-end-of-our-app-is-not-working-after-migration-from-apache-to-nginx">nginx rewriting to https</a>, also mentioned problems with POSTs losing data, and I'm not familiar enough with nginx to determine how well the solution works.</p>
  
  <p>And <a href="https://www.eff.org/https-everywhere/deploying-https" rel="noreferrer">EFF's recommendation to go HTTPS-only</a>, notes that:</p>
  
  <blockquote>
    <p>The application must set the Secure attribute on the cookie when
    setting it. This attribute instructs the browser to send the cookie
    only over secure (HTTPS) transport, never insecure (HTTP).</p>
  </blockquote>
  
  <p>Do apps like Django-auth have the ability to set cookies as Secure? Or do I have to write more middleware?</p>
  
  <p>So, what is the best way to configure the combination of Django/nginx to implement HTTPS-only, in terms of:</p>
  
  <ul>
  <li>security</li>
  <li>preservation of POST data</li>
  <li>cookies handled properly</li>
  <li>interaction with other Django apps (such as Django-auth), works properly</li>
  <li>any other issues I'm not aware of :)</li>
  </ul>
  
  <p><strong>Edit</strong> - another issue I just discovered, while testing multiple browsers. Say I have the URL <code>https://mysite.com/search/</code>, which has a search form/button. I click the button, process the form in Django as usual, and do a Django <a href="https://docs.djangoproject.com/en/1.3/ref/request-response/#django.http.HttpResponse" rel="noreferrer">HttpResponseRedirect</a> to <code>http://mysite.com/search?results="foo"</code>. Nginx redirects that to <code>https://mysite.com/search?results="foo"</code>, as desired. </p>
  
  <p>However - Opera has a visible <em>flash</em> when the redirection happens. And it happens every search, even for the same search term (I guess https really doesn't cache :) Worse, when I test it in IE, I first get the message:</p>
  
  <blockquote>
    <p>You are about to be redirected to a connection that is not secure - continue?</p>
  </blockquote>
  
  <p>After clicking "yes", this is immediately followed by:</p>
  
  <blockquote>
    <p>You are about to view pages over a secure connection - continue?</p>
  </blockquote>
  
  <p>Although the second IE warning has an option to turn it off - the <em>first</em> warning does not, so every time someone does a search and gets redirected to a results page, they get at least one warning message.</p>