Repository: stephenmcd/mezzanine

Issue:
Deprecate SSLRedirectMiddleware
Since Django 1.8 added [`SecurityMiddleware`](https://docs.djangoproject.com/en/1.9/ref/middleware/#module-django.middleware.security), I don't believe there's any functionality provided by `SSLRedirectMiddleware` that isn't provided there? It looks like maybe `SSL_FORCED_PREFIXES_ONLY` isn't covered, but IMO it's not worth keeping an extra middleware around for just that functionality.



Discussion:
I share David's opinion. With free solutions like Let's Encrypt and the general recommendation of "HTTPS everywhere", it's best to put an entire site behind HTTPS at the server level.

+1 from me. Good idea David.
On Mon, 16 May 2016 at 10:50 PM, Ed Rivas notifications@github.com wrote:

> I share David's opinion. With free solutions like Let's Encrypt and the
> general recommendation of "HTTPS everywhere", it's best to put an entire
> site behind HTTPS at the server level.
> 
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly or view it on GitHub
> https://github.com/stephenmcd/mezzanine/issues/1600#issuecomment-219444979

Consensus! Let's do it.


Resolving patch:
diff --git a/mezzanine/core/defaults.py b/mezzanine/core/defaults.py
--- a/mezzanine/core/defaults.py
+++ b/mezzanine/core/defaults.py
@@ -416,7 +416,7 @@
     description=_("If ``True``, users will be automatically redirected to "
         "HTTPS for the URLs specified by the ``SSL_FORCE_URL_PREFIXES`` "
         "setting."),
-    editable=True,
+    editable=False,
     default=False,
 )
 
@@ -425,7 +425,7 @@
     label=_("Force Host"),
     description=_("Host name that the site should always be accessed via that "
                 "matches the SSL certificate."),
-    editable=True,
+    editable=False,
     default="",
 )
 
diff --git a/mezzanine/core/middleware.py b/mezzanine/core/middleware.py
--- a/mezzanine/core/middleware.py
+++ b/mezzanine/core/middleware.py
@@ -1,5 +1,7 @@
 from __future__ import unicode_literals
 
+import warnings
+
 from django.contrib import admin
 from django.contrib.auth import logout
 from django.contrib.messages import error
@@ -221,6 +223,13 @@ class SSLRedirectMiddleware(MiddlewareMixin):
     Also ensure URLs defined by ``SSL_FORCE_URL_PREFIXES`` are redirect
     to HTTPS, and redirect all other URLs to HTTP if on HTTPS.
     """
+    def __init__(self, get_response):
+        warnings.warn(
+            "SSLRedirectMiddleware is deprecated. See "
+            "https://docs.djangoproject.com/en/stable/ref/middleware/"
+            "#module-django.middleware.security for alternative solutions.",
+            DeprecationWarning)
+        super(SSLRedirectMiddleware, self).__init__(get_response)
 
     def languages(self):
         if not hasattr(self, "_languages"):
diff --git a/mezzanine/project_template/project_name/settings.py b/mezzanine/project_template/project_name/settings.py
--- a/mezzanine/project_template/project_name/settings.py
+++ b/mezzanine/project_template/project_name/settings.py
@@ -273,8 +273,6 @@
     "mezzanine.core.middleware.TemplateForHostMiddleware",
     "mezzanine.core.middleware.AdminLoginInterfaceSelectorMiddleware",
     "mezzanine.core.middleware.SitePermissionMiddleware",
-    # Uncomment the following if using any of the SSL settings:
-    # "mezzanine.core.middleware.SSLRedirectMiddleware",
     "mezzanine.pages.middleware.PageMiddleware",
     "mezzanine.core.middleware.FetchFromCacheMiddleware",
 )


Test patch: