How to know using Django if server is secure (uses https)

Question

I work on a Django based app, and I want to know if there's a way to know if my server uses http connections or https.

I know that using

import socket
if socket.gethostname().startswith('****'):

I can get the hostname, is it possible to do something like that so I can get to know if the hosting uses a ssl certificate?

PD: I'm a rookie here, so I'm asking to see if it's possible and, if it is, how should I do it. Thanks

score 14 · Accepted Answer · edited May 23 '18 at 12:41

14

it's completely possible:

def some_request_function(request):
    if request.is_secure():
        #You are safe!
    else:
        #You are NOT safe!

edited May 23 '18 at 12:41

math

answered Feb 07 '14 at 16:26

Pedro Walter

score 4 · Answer 2 · answered Feb 07 '14 at 16:22

4

There simply is an is_secure() method on the request object, returning True if the connection is secure.

Depending on your specific server configuration you may also need to set SECURE_PROXY_SSL_HEADER in your settings.

answered Feb 07 '14 at 16:22

Ludwik Trammer

This seems more like what I'm looking for. How would it be in settings.py? – Sascuash Feb 07 '14 at 16:45
What server do you use (nginx, apache)? – Ludwik Trammer Feb 08 '14 at 21:01
nginx. Same question here (about settings.py) – stelios May 31 '17 at 19:13
@chefarov `SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')`. Also make sure you've got `proxy_set_header X-Forwarded-Protocol $scheme;` in you nginx configuration. – Ludwik Trammer Jun 01 '17 at 10:46

score 3 · Answer 3 · answered Feb 07 '14 at 16:22

3

django requests (HttpRequest) have is_secure method:

answered Feb 07 '14 at 16:22

dm03514

1

Just a question. How would it be in settings.py? – Sascuash Feb 07 '14 at 16:50
1

it's not. By default it checks the server enviorn (`os.environ`) to see if 'https' is the scheme https://github.com/django/django/blob/master/django/http/request.py#L137, It looks like you can define what a secure header is by defining SECURE_PROXY_SSL_HEADER in your settings though. https://docs.djangoproject.com/en/1.4/ref/settings/#secure-proxy-ssl-header – dm03514 Feb 07 '14 at 17:11

3 Answers3