title: SSL certificates and https for AWS hosted django site
body: <p>I have a django site hosted on elastic beanstalk. I have obtained a AWS SSL certificate and this has been associated with the load balancer 443 HTTPS port.</p>
  <p>In my config file I have:</p>
  <pre><code>MIDDLEWARE = [
  ...
      &quot;django.middleware.csrf.CsrfViewMiddleware&quot;,
  ]
  
  CSRF_COOKIE_HTTPONLY = False
  SESSION_COOKIE_HTTPONLY = True
  </code></pre>
  <p>With this setup I am able to login to the site but the browser displays 'not secure' in the address bar, and if I prepend 'https://' to the urls I get a page stating the connection is not private.</p>
  <p>If I add</p>
  <pre><code>SESSION_COOKIE_SECURE = True
  CSRF_COOKIE_SECURE = True
  </code></pre>
  <p>Then it becomes impossible to login (the login page just reloads) or if I got to a incognito browser I get a 'CSRF verification failed. Request aborted.' message.</p>
  <p>Apologies for the long question, I've just tried to include ay detail that may be relevant</p>