HTTPS and secure cookies in Django - Mini Project: Build & Apply

HTTPS and Secure Cookies in Django

📖 Scenario: You are building a Django web application that needs to be secure. You want to make sure your site uses HTTPS and that cookies are only sent over secure connections to protect user data.

🎯 Goal: Set up HTTPS enforcement and configure Django to use secure cookies for session and CSRF protection.

📋 What You'll Learn

Create a Django settings variable to enable HTTPS redirect

Add a variable to set cookies as secure

Configure session and CSRF cookies to be secure

Complete the settings to enforce HTTPS and secure cookies

💡 Why This Matters

🌍 Real World

Websites that handle user logins, personal data, or payments must use HTTPS and secure cookies to protect users from data theft and attacks.

💼 Career

Understanding how to configure HTTPS and secure cookies is essential for web developers and security engineers to build safe web applications.

1

Enable HTTPS redirect

In your Django settings.py file, create a variable called SECURE_SSL_REDIRECT and set it to True to force all HTTP requests to redirect to HTTPS.

Django

# Your code here

Need a hint?

This setting tells Django to redirect all HTTP requests to HTTPS automatically.

2

Set cookies to be secure

Add a variable called SESSION_COOKIE_SECURE and set it to True in settings.py to ensure session cookies are only sent over HTTPS.

Django

SECURE_SSL_REDIRECT = True
# Your code here

Need a hint?

This makes sure the session cookie is only sent on secure HTTPS connections.

3

Secure CSRF cookie

Add a variable called CSRF_COOKIE_SECURE and set it to True in settings.py to make the CSRF cookie secure.

Django

SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
# Your code here

Need a hint?

This setting ensures the CSRF cookie is only sent over HTTPS.

4

Complete HTTPS and secure cookies setup

Add a variable called SECURE_HSTS_SECONDS and set it to 3600 in settings.py to enable HTTP Strict Transport Security (HSTS) for one hour.

Django

SECURE_SSL_REDIRECT = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
# Your code here

Need a hint?

This setting tells browsers to only use HTTPS for your site for the next hour.