HTTPS, HSTS, and Secure Cookies
Force encrypted, secure connections.
Why HTTPS Matters
Plain HTTP sends passwords and cookies as readable text anyone on the network can grab. HTTPS encrypts the whole conversation between browser and server. 🔐
Redirect HTTP to HTTPS
Turn on SECURE_SSL_REDIRECT so Django bounces any plain HTTP request to its HTTPS version automatically. No more accidental insecure pages.
SECURE_SSL_REDIRECT = TrueAll lessons in this course
- DEBUG, SECRET_KEY, and ALLOWED_HOSTS
- HTTPS, HSTS, and Secure Cookies
- XSS, CSRF, and SQL Injection Defenses
- Running the Deployment Checklist