3

我正在使用 django-braces'LoginRequiredMixin作为我的观点之一。基本上，这会添加一个?next=/my/desired/urlto的查询字符串http://example.com/login/。

问题是，我在我的网站上使用 ssl 证书。我的 nginx 文件如下：

upstream app_server {
    server 127.0.0.1:9000 fail_timeout=0;
}
#
# Redirect all www to non-www
#
server {
    server_name          www.example.com;
    ssl_certificate      /src/bin/ssl/ssl-bundle.crt;
    ssl_certificate_key  /etc/ssl/private/STAR_example_com.key;
    ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
    listen               *:80;
    listen               *:443 ssl spdy;
    listen               [::]:80 ipv6only=on;
    listen               [::]:443 ssl spdy ipv6only=on;

    return 301 https://example.com$request_uri;
}

#
# Redirect all non-encrypted to encrypted
#
server {
    server_name          example.com;
    listen               *:80;
    listen               [::]:80;

    return 301 https://example.com$request_uri;
}

server {
    server_name          example.com;
    ssl_certificate      /src/bin/ssl/ssl-bundle.crt;
    ssl_certificate_key  /etc/ssl/private/STAR_example_com.key;
    ssl_protocols        TLSv1 TLSv1.1 TLSv1.2;
    listen               *:443 ssl spdy;
    listen               [::]:443 ssl spdy;

    # rest goes here...

    root /usr/share/nginx/html;
    index base.html index.html index.htm;

    client_max_body_size 4G; 

    keepalive_timeout 5;

    # Your Django project's media files - amend as required
    location /media  {
        alias /src/example/media;
    expires 1y; 
    add_header Cache-Control "public";
    }   

    # your Django project's static files - amend as required
    location /static {
        alias /src/static;
    expires 1y; 
    add_header Cache-Control "public";
    } 

    location / { 
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Ssl on; 
        proxy_set_header Host $http_host;
        proxy_redirect off;
        proxy_pass http://app_server;
    }   
}

我有一个 AJAX 搜索提交，我已将 URL 设置为 https。不幸的是，我仍然收到此错误：

Mixed Content: The page at 'https://example.com/my/url/' was loaded 
over HTTPS, but requested an insecure XMLHttpRequest endpoint 
'http://example.com/login/?next=/amazon/%3FsearchTerms%3DmySearchTerms'. 
This request has been blocked; the content must be served over HTTPS.

我需要在我的 nginx 文件中进行哪些更改才能使此请求生效？这基本上是因为没有使用 https 设置登录重定向。

我尝试添加对Django @login_required 删除 httpsSECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https')的每个响应，以及此处的文档，但无济于事。谢谢你的帮助！

4

0 回答 0