Django named URLs and HTTPS/SSL - django

Question

I'm currently working on securing my Django website with SSL. I'd like certain URL patterns to be accessible only via HTTPS. The single most important thing to do is to secure the login site. There is this form where user inputs their login/password into a form and the form is POSTed to the server. In the login page template I have something like
<form method="POST" action="{% url login %}">
and in my urls.py one of the patterns is something like
url(r'^login/$', 'mySiteLogin', name='login'),
Now I've found some resources suggesting that I should use a middleware that will rewrite http to https, for example this: Django relative urls and https. But logging in cannot be done this way - it's no use to rewrite the protocol when the user has already POSTed their password in plaintext!
So I'm thinking, can I somehow tell {% url %} to use https? I'm thinking of a solution that will use a decorator to mark views that require encryption and then some tag similar to {% url %} will use this info and create a link with https when required.
Or is there some other way?
Thanks,
Mike

Answer 1

But logging in cannot be done this way
- it's no use to rewrite the protocol when the user has already POSTed their
password in plaintext!
Just serve the login page itself over HTTPS. This seems to be a good idea in general.
“By January 5, it was clear that an
entire country’s worth of passwords
were in the process of being stolen
right in the midst of the greatest
political upheaval in two
decades.”—which is why you shouldn’t
serve your login form over HTTP even
though it POSTs over HTTPS.
http://simonwillison.net/2011/Jan/24/
In a nutshell, ISPs from Tunisia injected malicious JavaScript code into the login pages of Facebook to steal user logins.

Answer 2

Maybe you should instead look at middleware solutions that does redirection between HTTP and HTTPS. One example: http://djangosnippets.org/snippets/85/