I have configured nginx to run HTTPS. I also rewrite all the rules so it’s running under HTTPS.
But is it true that Django still runs with HTTP internally?
Django version 1.2.1, using settings 'myproject.settings'
Development server is running at http://127.0.0.1:8000/
Quit the server with CONTROL-C.
[14/Aug/2012 23:57:04] "GET /app/c HTTP/1.0" 200 4
[14/Aug/2012 23:57:09] "GET /app/c HTTP/1.0" 200 4
Yes. I know my version is way way way outdated.
I checked request.is_secure and it returns True as I am accessing HTTPS.
Correct, internally you will use http to communicate through your proxy server but all your external traffic will use the https method.
To further secure your traffic ensure that you only bind to a local address, or alternatively use a socket to connect between nginx and your application server.
I do hope that you’re not using django’s development server in production, you should instead use something like gunicorn as your application server.