Re: Security middleware for django for insecure (http) connections

2018-01-16 Thread Josh Smeaton
HTTPS is enough. Despite that, how would you handle the **client** doing decryption and encryption? I don't think this is an idea you should pursue, especially if your expertise is not in security. On Tuesday, 16 January 2018 10:03:00 UTC+11, Vishwas Mittal wrote: > > Hello everyone, > > I am a

Re: Security middleware for django for insecure (http) connections

2018-01-16 Thread Jani Tiainen
Hi, Also there exists HTTPS devserver (at least one is https://github.com/teddziuba/django-sslserver ) which does it's job pretty well. Used it when had to demonstrate javascript location services (which do require HTTPS at least on chrome). So I'm pretty convinced that this subject can be d

Re: Security middleware for django for insecure (http) connections

2018-01-15 Thread Shai Berger
Hi Vishwas, Can you state the circumstances in which this middleware will be useful? Note that with the help of Let's Encrypt[1], a HTTPS certificate is freely available to anyone, so there is no financial barrier to using it. Over and beyond the subject matter, is there anything preventing imple

Security middleware for django for insecure (http) connections

2018-01-15 Thread Vishwas Mittal
Hello everyone, I am a new contributor to django, and would like to propose a new middleware to django that can provide some degree of security for HTTP connections by encrypting the data to be sent in response. This middleware will work on the principles of HTTPS but the main difference is th