Django Password Reset generating http link instead of https

Question

I am using Django's inbuilt password reset mechanism. It sends an email with a link containing a token, which when clicked can be used to reset the password. However, the link being generated is using the template:

{% trans "Please go to the following page and choose a new password:" %}
{% block reset_link %}
{{ protocol }}://{{ domain }}{% url 'password_reset_confirm' uidb64=uid token=token %}
{% endblock %}

Here, the {{ protocol }} is returning http instead of https. My nginx server would redirect any http requests to the https base link (the homepage).

Hence, the password reset link does not work since the link generated is wrong. It simply goes to the homepage via nginx.

How do I fix this?

user_1393496 · Answer

This is likely an issue with X-Forwarded-Protocol in your nginx config.

You need to add this inside your location block:

proxy_redirect off;
proxy_set_header X-Forwarded-Proto $scheme;

For more info see: https://djangodeployment.com/2017/01/24/fix-djangos-https-redirects-nginx/

Django Password Reset generating http link instead of https

1 Answers