Running the django admin over https using apache2

Question

I have a django web application that's running on apache 2.2.14 and I want to run the admin application over https.

Having read considerable discussions on using a proxy, writing middleware, running alternative wsgi scripts, the chaps in #httpd came to my rescue. The solution is so simple, I was surprised I didn't find it online, so I'm curious to see if I've made some glaring assumptions or errors.

One complication was that I also wanted to run one of my django apps in the site over https, that is everything on /checkout.

Essentially, if a user requests a URI starting with /admin or /checkout on http, they are to be redirected to that URI but on https. Conversely, if a user requests a URI that does not start with /admin or /checkout on https, they are to be redirected to that URI but on http.

The key to solving this problem was to use Redirect and RedirectMatch directives in my VirtualHost configuration.

<VirtualHost *:80>

    ... host config stuff ...

    Redirect /admin https://www.mywebsite.com/admin
    Redirect /checkout https://www.mywebsite.com/checkout

</VirtualHost>
<VirtualHost *:443>

    ... ssl host config stuff ...

    RedirectMatch ^(/(?!admin|checkout).*) http://www.mywebsite.com$1

</VirtualHost>

If anyone spots a hole in what I've done, or can add anything, please let me know. I spent a lot of hours going down lots of blind alleys trying to get this to work. Big thanks to Thumbs and Jink who gave me their time in irc, and to SmileyChris for the inspiration.

Answer 1

What you described should work, but there may be a problem in the future if you need to make changes to which paths are/are not HTTPS. Because this method requires the ability to correctly modify the Apache config file it means you do not want novices in the loop. Screw up the config file and your site can go 500-error in the blink of an eye.

We chose to have a simple text file that had a list of the must-be-HTTPS paths. Anyone on the project can edit it and it is checked for correctness when it is loaded. We handle any needed redirects to/from HTTPS in middleware and it seems to work just fine. This method will also work if you are running anything other than Apache.