HTTPS, HSTS, and Secure Cookies

Plain HTTP sends passwords and cookies as readable text anyone on the network can grab. HTTPS encrypts the whole conversation between browser and server. 🔐

Turn on SECURE_SSL_REDIRECT so Django bounces any plain HTTP request to its HTTPS version automatically. No more accidental insecure pages.

Behind Nginx, Django needs to know the request arrived over TLS. The SECURE_PROXY_SSL_HEADER tells it which header to trust for that.

HSTS tells browsers to only ever talk to your site over HTTPS for a set time. Even typing http will be upgraded before any request leaves the browser.

Set SECURE_HSTS_SECONDS to enable HSTS. Start small while testing, since browsers will remember it and refuse plain HTTP until it expires.

Cover every subdomain and qualify for preload lists with two extra flags. They make HSTS apply broadly and let browsers ship it built in.

Your session and CSRF cookies authenticate users. If they leak over HTTP, an attacker can hijack the session, so they need protection flags too.

Set SESSION_COOKIE_SECURE to True so the session cookie is only ever sent over HTTPS, never on an unencrypted connection.

Do the same for CSRF protection. With CSRF_COOKIE_SECURE on, the token cookie also refuses to ride along over plain HTTP.

The HttpOnly flag hides the session cookie from JavaScript, so a cross-site script cannot read and steal it. Django sets it on sessions by default.

The SameSite attribute stops cookies from being sent on cross-site requests, adding a second layer of CSRF defense. Django defaults it to Lax for you.

Let us see if the HSTS idea stuck.

You forced HTTPS, taught browsers to remember it with HSTS, and marked your cookies secure and HttpOnly. Traffic and sessions are now encrypted end to end. ✨