Understanding Django's HTTPS Detection and Potential Improvements

You've raised an important issue regarding how Django determines whether a request is secure (served over HTTPS), particularly in relation to CSRF protection.

Current HTTPS Detection Mechanism

Django currently determines if a request is secure through:

1. The SECURE_PROXY_SSL_HEADER setting (if configured)
2. The "wsgi.url_scheme" environ key for WSGI applications

The Problem

The current approach presents challenges:

• Configuring SECURE_PROXY_SSL_HEADER correctly varies across different hosting environments
• Since Django 4.0, CSRF protection checks the Origin header using this method, causing issues for many users
• Modern projects where HTTPS is standard still need to configure this setting properly

Security Considerations

The SECURE_PROXY_SSL_HEADER setting comes with important security warnings:

PYTHONCopied
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")

For this to be secure, all of the following must be true:

• Your Django app is behind a proxy
• Your proxy strips the X-Forwarded-Proto header from all incoming requests
• Your proxy sets the X-Forwarded-Proto header only for requests that originally come in via HTTPS

Misconfiguration can lead to security vulnerabilities, particularly with CSRF protection.

Recommended Security Settings

When deploying with HTTPS, Django recommends several security settings:

1. Configure SECURE_PROXY_SSL_HEADER correctly if behind a proxy
2. Set SECURE_SSL_REDIRECT to True to redirect HTTP requests to HTTPS
3. Enable secure cookies:
   • SESSION_COOKIE_SECURE = True
   • CSRF_COOKIE_SECURE = True
4. Implement HTTP Strict Transport Security (HSTS)

Potential Solution

Your suggestion to add a toggle setting that allows developers to assert "This project is always served with HTTPS" has merit. This would simplify configuration for projects that are guaranteed to be served over HTTPS.

Such a setting would need to:

• Be clearly documented with security implications
• Work alongside existing security settings
• Provide a reliable way for HttpRequest.is_secure() to return True

This approach could reduce configuration burden while maintaining security, especially for modern deployments where HTTPS is standard.

However, any implementation would need careful consideration to avoid creating new security vulnerabilities, particularly for deployments with mixed HTTP/HTTPS traffic or complex proxy setups.