I was finally able to resolve with a combination of a few things:
Removing
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')from the Django settings.py and instead using sslify to force https redirect in place of that.Making sure the trailing '/' was present in the original CORS request destination url which also causes a 3xx redirect.
Doubling up the headers on the server side of AWS by adding
'Access-Control-Allow-Origin': '*','Access-Control-Allow-Methods': 'POST, OPTIONS','Access-Control-Allow-Headers': 'content-type',to the AWS_HEADERS setting in Django's settings.py.Adding another, likely redundant, https force within wsgi by adding
os.environ['wsgi.url_scheme'] = 'https'to Django's settings.py. You can also do this by adding another https forceos.environ['https'] = "on"within wsgi.py.
All of these things together proved to work, the last one is most likely redundant but sometimes the request would fail to be recognized as https without it. In all likelihood this could have been due to caching, but better safe than sorry.
Hopefully this helps someone like me who was dealing with this issue for a while without any clear solution.
Answer from Charles Morse on Stack OverflowI'm using Django with AWS Application Load Balancer which holds the https/ssl certificate.
I want to terminate the SSL at the Load balancer, so that the load balancer will connect to the nginx/django via http.
However, I'm not sure how I can securely configure django to accept http connections from the load balancer.
I currently have these https settings:
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
SECURE_HSTS_SECONDS = 3600 # increase to 1 year eventually
SECURE_SSL_REDIRECT = True #re enable in product
SECURE_HSTS_INCLUDE_SUBDOMAINS = TrueIs it safe to disable/remove any of these, if I have SSL termination at the load balancer?
Or if not, how can I safely put Django behind AWS Load balancer with docker and nginx?
CONCLUSION:
Finally managed to set this up ended up using load balancer(https aws certs) - > nginx (https own certs) - > django.
The managing two certs parts is made a lot easier by using private certs with nginx e.g. by generating them with openssl.