Heroku上的Django SSL重定向：“重定向过多”

Question

I have a web app deployed to Heroku with a custom domain name which DNS is managed through CloudFlare.

What I want to do is redirect HTTP requests to HTTPS .

After setting SECURE_SSL_REDIRECT to True, according to Django's documentation , I encounter a Too many redirects (or site redirected you too many times ) error while accessing the site via the custom domain.

This is what I have in my settings.py file:

SECURE_SSL_REDIRECT = True
SECURE_PROXY_SSL_HEADER = ('X-Forwarded-Proto', 'https')

Note that this redirect works with the myapp.herokuapp.com domain.

I am using DNS + Proxy on CloudFlare, and SECURE_PROXY_SSL_HEADER is set according to Heroku's documentation .

Here is the Heroku log:

2019-04-17T11:21:08.514202+00:00 heroku[router]: at=info method=GET path="/" host=staging.mywebsite.com request_id=cf90ab0c-0895-4faf-aeea-5ee5fe5f970d fwd="115.87.132.194,172.68.242.176" dyno=web.1 connect=0ms service=2ms status=301 bytes=228 protocol=http

Answer 1

As I understand 'Cloudflare', is that it uses proxies for making your website faster. In combination with heroku it will lead in 'Too many redirects' if the proxy is enabled.

Make sure the cloud in Cloudflare DNS is not set to orange and will not use a proxy before your server.

You can set up SSL in heroku see: https://devcenter.heroku.com/articles/ssl-endpoint

Answer 2

Django modifies the format of the header, so "X-Forwarded-Proto" becomes "HTTP_X_FORWARDED_PROTO", so you should replace 'X-Forwarded-Proto' with 'HTTP_X_FORWARDED_PROTO' in your example.

From the Django documentation :

Note that the header needs to be in the format as used by request.META – all caps and likely starting with HTTP_. (Remember, Django automatically adds 'HTTP_' to the start of x-header names before making the header available in request.META.)

There is also an example for this exact header.

Set a tuple with two elements – the name of the header to look for and the required value. For example:

 SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https') 

This tells Django to trust the X-Forwarded-Proto header that comes from our proxy, and any time its value is 'https', then the request is guaranteed to be secure (ie, it originally came in via HTTPS).

Answer 3

There is note in the Django documentation for SECURE_SSL_REDIRECT stating that:

If turning this to True causes infinite redirects, it probably means your site is running behind a proxy and can't tell which requests are secure and which are not. Your proxy likely sets a header to indicate secure requests; you can correct the problem by finding out what that header is and configuring the SECURE_PROXY_SSL_HEADER setting accordingly.

Answer 4

After trying multiple approaches with this and always getting a "Too Many Redirects" error, I simply decided to do all the redirect from CloudFlare and remove it from my Django App.

Here is the documentation .