is_secure already takes care of the HTTP_X_FORWARDED_PROTO header

is_secure only checks the HTTP_X_FORWARDED_PROTO header, if SECURE_PROXY_SSL_HEADER is set correctly. no need to check it again. also this header could can be faked an should only be used with a trusted proxy (eg. via explicitly setting django's SECURE_PROXY_SSL_HEADER)