Search code examples
djangonginxsslgunicorn

Cookies between nginx and gunicorn with ssl and without it


Now in my django project everything is configured without Nginx. I've never used it before and I want to use it now. My cookies (sessionid) are protected and httponly. I have one self-written SSL certificate for 127.0.0.1:8000.

I'm interested in how cookies will be transmitted if the connection between Nginx and the frontend is HTTPS, and between Nginx and Gunicorn is HTTP. Will Nginx decrypt them and pass them on to Django, who in turn will receive them? Is it possible to somehow use the same SSL certificate for Nginx and Gunicorn?


Solution

  • The classical way to do so is to use HTTPS between the client and nginx, and HTTP between nginx and gunicorn.

    If your gunicorn is exposed only through nginx, there are no advantages of using ssl on gunicorn.

    But to answer your second question, it seems that you can use your self signed certificate on gunicorn, and use https between nginx and gunicorn. See this question for nginx implementation, and this one for gunicorn implementation.