The recommended way for securing django admin with SSL/HTTPS

Question

Well, was wondering what the recommended way for securing the django admin site with webfaction certificate, an internet search recommend the use of a middleware (which I'm not familar with), but was wondering is there a recommended & easy way for doing so in webfaction?

Answer 1

3

Yes, there is a much easier way to do this than through a middleware component. Simply host your django application on two website records simultaneously -- one for HTTP, and one for HTTPS. The front-end Nginx webserver will handle removing the encryption layer, which then forwards to your Django application. This allows SSL to be used transparently with your existing application.

Optionally, you can then implement a redirect in your httpd.conf for the HTTPS website to redirect to your HTTP site, for all URLs that do not fall under /admin. For example:

RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-SSL} on
RewriteCond %{REQUEST_URI} !^/admin
RewriteRule .* http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

And you may want a parallel one for redirecting non-HTTPS requests for /admin to the HTTPS site:

RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-SSL} !on
RewriteCond %{REQUEST_URI} ^/admin
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

permanent link

answered 02 Dec '10, 00:58

ryans ♦♦
5.0k●10●39●60
accept rate: 43%

How would I use this, for example, when I "host your django application on two website records simultaneously" where one is prefixed with secure.mysite.com and the other is just www.mysite.com ?

More specifically what I'ms asking is the http.conf ... are they dynamic variables declared elsewhere? Or are they hand modified by me for these example urls.

(11 May '11, 13:13) JBlack

@JBlack:

The variables shown above are the HTTP headers that come in with the request.

If secure.mysite.com is HTTPS-only, and www.mysite.com is HTTP-only, then you should be able to use the above example without modification, since the SSL header is the condition that controls the rewrites.

If not and you need a condition that checks for the hostname used in the request, then you can use the %{HTTP_HOST} variable in a rewrite condition, like this:

RewriteEngine on

# force HTTP for the www subdomain
RewriteCond %{HTTP:X-Forwarded-SSL} on
RewriteCond %{HTTP_HOST} www.mysite.com
RewriteCond %{REQUEST_URI} !^/admin
RewriteRule .* http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

# force HTTPS for the secure subdomain
RewriteCond %{HTTP:X-Forwarded-SSL} !on
RewriteCond %{HTTP_HOST} secure.mysite.com
RewriteCond %{REQUEST_URI} ^/admin
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

(11 May '11, 15:58) seanf

If I want login and checkout to be under a secure ssl url as well can I comma serpate additional subfolders to this same rule. Do I repeat the line "RewriteCond %{REQUEST_URI} !^/admin" for each folder I want within the condition statements? Or do I declare each one in there individual sections with repeating lines of code?

(17 May '11, 15:20) JBlack

I'd do it by using a single regex like "(admin|login|checkout)" that matches any of the URLs that you want to redirect, eg:

RewriteEngine on

# force HTTP for the www subdomain
RewriteCond %{HTTP:X-Forwarded-SSL} on
RewriteCond %{HTTP_HOST} www.mysite.com
RewriteCond %{REQUEST_URI} !^/(admin|login|checkout)
RewriteRule .* http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

# force HTTPS for the secure subdomain
RewriteCond %{HTTP:X-Forwarded-SSL} !on
RewriteCond %{HTTP_HOST} secure.mysite.com
RewriteCond %{REQUEST_URI} ^/(admin|login|checkout)
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

(17 May '11, 15:59) seanf

Answer 2

I'm not sure if this is what everyone means, but the simplest solution I have found is this:

Log in to your webfaction control panel.
Under Domains/websites choose websites, then select the website you wish to secure with ssl.
Click the button to edit it.
Check the box that says Https*?
Click update.
Try visiting https://yoursite.com.

It might take a little while for the update to take affect. One of the other answers shows you how to update your httpd.conf to redirect only /admin to https.

As a note I noticed that when I first checked https and updated the https version of the site didn't work. Then I unchecked it and pressed update again. The https version of the site immediately started working but then stopped after a few minutes. I checked it again, and it didn't work (i'm assuming after some period of time it would start working), so I unchecked it, and made sure it worked which it did and then immediately rechecked the option. It continued working and hasn't stopped since.

The recommended way for securing django admin with SSL/HTTPS

Follow this question

Related questions