Django HTTPS 和 HTTP 会话
我使用 Django 1.1.1 和 ssl 重定向中间件。
通过 HTTPS 创建的会话数据（身份验证等）在站点的 HTTP 部分中不可用。
无需将整个站点设置为 HTTPS 即可使其可用的最佳方法是什么？
I'm using Django 1.1.1 with the ssl redirect middleware.
Sessions data (authentication etc.) created via HTTPS are not available in the HTTP portions of the site.
What is the best way to make it available without having to make the entire site HTTPS?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这是设计使然，您无法轻易更改。
当通过 HTTP 查看同一站点时，浏览器不会发送通过 HTTPS 发送的 Cookie/身份验证。最好的解决方案可能是将用户从 HTTPS 页面重定向到设置身份验证 cookie 的 HTTP 页面。
请记住，这种未经身份验证的 cookie 通过网络以明文形式发送，会使您的用户遭受欺骗和重放攻击。这对于您的应用程序可能并不重要。
This is by design, and not something you can readily change.
Cookies/authentication sent via HTTPS are not sent by the browser when the same site is viewed via HTTP. Your best solution is probably to redirect the user from a HTTPS page to a HTTP page that sets your authentication cookie.
Keep in mind that this unauthenticated cookie, sent in plaintext over the wire, opens your users to spoofing and replay attacks. This may not matter for your application.
一直有类似的问题。 #django IRC 上的用户 iiie 向我指出了此设置：
SESSION_COOKIE_DOMAIN(https://docs.djangoproject.com/en/dev/ref/settings/#session-cookie-domain )将此选项设置为
".domain.com"< /code> 允许我在 HTTP/HTTPS 之间以及跨域和主机/子域共享会话。我可以想象一种情况，人们不想要这两者，但它现在解决了我的问题。
Been having a similar issue. User iiie on #django IRC pointed me to this setting:
SESSION_COOKIE_DOMAIN( https://docs.djangoproject.com/en/dev/ref/settings/#session-cookie-domain )Setting this option to
".domain.com"allowed me to share sessions between HTTP/HTTPS as well as across the domain and hosts/subdomains.I could imagine a situation where one didn't wan't both of those but it solves my issue for now.