How to force the use of SSL for some URL of my Django Application?

Question

I want to be sure that for some URL of my website, SSL will be use. I saw a lot of answer already on SO.

https://stackoverflow.com/questions/724968/force-redirect-to-ssl-for-all-pages-apart-from-one

So I think I will use mod_rewrite.

My question is more about how to configure the Virtual Host to run my Django Application over HTTP and over HTTPS without problems. I am using WSGI.

Is it a problem to just duplicate the configuration over *:443 and over *:80 ? How should I do to have the best configuration ?

Thank you.

Rémy

Maybe this is related : http://effbot.org/zone/django-multihost.htm — Natim, Oct 10 '09 at 16:00
Answers on StackOverflow at 'http://stackoverflow.com/questions/1548210/how-to-force-the-use-of-ssl-for-some-url-of-my-django-application'. — Graham Dumpleton, Oct 11 '09 at 02:21

score 3 · Accepted Answer · answered Jul 26 '10 at 05:34

3

you can use a decorator on your views to make them only avail from ssl.

@secure_required
@login_required
def edit_member(request, slug):
    ...

http://www.redrobotstudios.com/blog/2009/02/18/securing-django-with-ssl/

answered Jul 26 '10 at 05:34

user49320

46
3

score 0 · Answer 2 · answered Jun 25 '10 at 11:13

It is fine to copy over the configuration for *:443, here's how I did it on my server:

<VirtualHost *:80>
        ServerName www.mydomain.tld
        ServerAlias mydomain.tld

        DocumentRoot /path/to/www
        <Directory /path/to/www>
                AllowOverride All
                Order allow,deny
                allow from all
                Options -MultiViews
        </Directory>

</VirtualHost>

<VirtualHost *:443>
        ServerName www.mydomain.tld
        ServerAlias mydomain.tld

        DocumentRoot /path/to/www
        <Directory /path/to/www>
                AllowOverride All
                Order allow,deny
                allow from all
                Options -MultiViews
        </Directory>

        SSLEngine On
        SSLCertificateFile /etc/ssl/private/mydomain.crt

</VirtualHost>

Be sure to activate SSL on the *:443 virtual host (SSLEngine), and have your certificate set-up also (SSLCertificateFile).

You will also need to activate the ssl module for Apache2, type as root:

a2enmod ssl

With Django it is not that simple. But thanks anyway, the answer is on the StackOverflow post overthere. — Natim, Jun 26 '10 at 11:08

How to force the use of SSL for some URL of my Django Application?

2 Answers2