如何在没有代理的情况下安全地重定向到 Django 应用程序上的 HTTPS？

Question

essentially, I want to turn SECURE_SSL_REDIRECT to true. but reading through the django docs, I get the impression this can compromise the projects security if it's not behind a proxy.

am I understanding that correctly, and if so, how should I go about doing http->https redirects when not behind a proxy?

thanks!

Answer 1

如果有人发现这一点，看起来使用 Heroku 意味着这很好，因为 Heroku 写入 X_FORWARDED_PROTO 标头，无论传入的标头是什么，因此无法将其恶意设置为 https