Django HTTPS Settings: Why Does Setting Both SESSION_SAVE_EVERY_REQUEST And SESSION_COOKIE_SECURE Break Sessions?

I'm trying to lock my django app down to only HTTPS access. Everything seems to work fine if only SESSION_SAVE_EVERY_REQUEST is True or if only SESSION_COOKIE_SECURE is True, but i

Solution 1:

Found it! I needed to set a setting to convince django that I am really on https even though I'm hiding behind nginx:

SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTOCOL', 'https')

Reference: https://docs.djangoproject.com/en/dev/ref/settings/#secure-proxy-ssl-header