build_absolute_uri with HTTPS behind reverse proxy

Question

I'm serving my django app behind a reverse proxy

The internet -> Nginx -> Gunicorn socket -> Django app

In the nginx config:

upstream my_server {
  server unix:/webapps/my_app/run/gunicorn.sock fail_timeout=0;
}

The SSL is set up with certbot at the nginx level.

request.build_absolute_uri in views.py generates http links. How can I force it to generate https links?

I just spent several hours to find out that I have this same question. `request.build_absolute_uri` sounds so strongly like it would solve this problem that it took me long to recognize it may not. — Lutz Prechelt, Aug 05 '22 at 09:00

score 28 · Accepted Answer · edited Jun 01 '22 at 14:32

28

By default Django ignore all X-Forwarded headers, base on Django docs.

Force read the X-Forwarded-Host header by setting USE_X_FORWARDED_HOST = True and set SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https'). So in settings.py:

USE_X_FORWARDED_HOST = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

edited Jun 01 '22 at 14:32

Cesar Canassa

18,659
11
66
69

answered Jan 28 '21 at 09:19

Ali ZahediGol

876
2
10
20

1

Thanks for explanation. For anyone wanting a more detailed explanation of how nginx works with django and how to make sure nginx conf is set correctly to use these settings, then I recommend to check this article: https://mattsegal.dev/nginx-django-reverse-proxy-config.html – Vasco May 24 '22 at 10:19
Instead of HTTP_X_FORWARDED_PROTO the HTTP_X_FORWARDED_SCHEME worked better in our AKS environment. – szabozoltan Aug 28 '23 at 16:42

user3486626 · Answer 2 · 2021-07-09T03:07:21.210

1

I use django behind apache2 so my solution was to put this on apache2

<VirtualHost *:443>
  RequestHeader set X-Forwarded-Proto 'https' env=HTTPS

After adding headers mod:

a2enmod headers

And this on django setting.py:

USE_X_FORWARDED_HOST = True
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

With this all my build_absolute_uri started with https

edited Jul 09 '21 at 03:07

answered Jul 09 '21 at 03:01

user3486626

139
1
6

score -1 · Answer 3 · answered May 27 '20 at 16:51

-1

There's a note in the django documentation here https://docs.djangoproject.com/en/3.0/ref/request-response/#django.http.HttpRequest.build_absolute_uri:

Mixing HTTP and HTTPS on the same site is discouraged, therefore build_absolute_uri() will always generate an absolute URI with the same scheme the current request has. If you need to redirect users to HTTPS, it’s best to let your Web server redirect all HTTP traffic to HTTPS.

answered May 27 '20 at 16:51

Alex

60
8

3

My web server already redirects. This does not solve the problem that build_absolute_uri generates HTTP links – Saturnix May 28 '20 at 00:47

build_absolute_uri with HTTPS behind reverse proxy

3 Answers3

Linked