How to safely redirect to HTTPS on Django app not behind a proxy?

Question

essentially, I want to turn SECURE_SSL_REDIRECT to true. but reading through the django docs, I get the impression this can compromise the projects security if it's not behind a proxy.

am I understanding that correctly, and if so, how should I go about doing http->https redirects when not behind a proxy?

thanks!

Answer 1

if anyone finds this, it looks like using Heroku means this is fine, as Heroku writes the X_FORWARDED_PROTO header, regardless of what the incoming header is, so theres no way for it to be set as https maliciously