Security middleware for insecure (HTTP) connections

[Vishwas Mittal]

Hello everyone,

I am starting my contribution to Django and I would like to propose a security middleware that can provide some layer of security even in HTTP connections by encrypting the request and response.

Here I will implement an SSL type feature in the backend and will also provide a corresponding frontend implementation that can be used to complete the encryption-decryption couple.

Please share your thoughts and valuable suggestions, I will appreciate any type of help I can get from you.

P.S. This is just a brief intro about the feature, if you like this and feels something achievable then we can discuss it in detail.

Regards
Vishwas

[Aymeric Augustin]

Why should Django reinvent HTTPS instead of simply recommend to use it?

[Vishwas Mittal]

Replying to Aymeric Augustin:

Why should Django reinvent HTTPS instead of simply recommend to use it?

Sometimes many users (including me) uses their Django server on the computer only (for local networks) this can pose some problem of security and sometimes for some servers (say for non-commercial purposes) the server can be HTTP.

Here I am not saying to use it every time, there can be a check if the network is not HTTPS then we can use it's protection else just bypass it.

[Jani Tiainen]

There already exists 3rd party app(s) that does the job. (​https://github.com/teddziuba/django-sslserver being one example).

I don't see much of enhancement over that library and it seems to be relatively solid implementation for development purposes.

[Vishwas Mittal]

Replying to Jani Tiainen:

There already exists 3rd party app(s) that does the job. (​https://github.com/teddziuba/django-sslserver being one example).

I don't see much of enhancement over that library and it seems to be relatively solid implementation for development purposes.

And it's standard HTTPS, no need to have anything special "frontend" or "backend".

Yeah, you are right! I didn't find this type of apps earlier. Thanks for your suggestions.

[Tim Graham]

The ​django-developers discussion hasn't yielded a consensus to incorporate this into Django.