At the moment my django site's email confirmation links are not clickable for about 60 seconds. However, if I open them using right click open in new incognito window they work.

I do have the following setting -- so the 60 seconds makes sense.


This, from my understanding at least, is due to this setting in my production settings.py


When I remove the include subdomains setting, I can click my links and all is well. I want users to be able to sign up, but I also don't want to compromise security.

My email confirmation link is also being sent as http, as opposed to https. I am trying to get the link to generate as https, but have been unsuccessful. How big of a risk does sending the email confirmations as http pose?

I'm currently using mailgun to handle my emails and they don't support HSTS. So I am trying to figure out how necessary HSTS is, and if I should simply not be concerned about it, or find another service / workaround.

Here is another post I made on StackOverflow trying to figure this all out if you'd like more details.

Thanks in advance. Been stuck on this for weeks.


HSTS forces the browser to use HTTPS and protects it from falling victim to protocol downgrade attacks to HTTP.

It basically forces everything to use HTTPS and ensure secure communication between browser and server to prevent leaking sensitive information over a clear connection. The way it works is IF the browser has previously visited the website AND it has seen the HSTS for the website before, it will always force a secure connection. If it hasn't the HSTS header before, then your site users may still be vulnerable to an SSLstrip attack as the attacker may remove the HSTS header.

This communication is used between your website visitor and your server. Normally this header should not be relevant to Mailgun unless you have included a subdomain which points to Mailgun. The reason why HSTS may not be used is that it will force the subdomains to be using a valid SSL certificate. However the SSL certificate will be invalid as it's pointing to mailgun's domain and not yours.

Is this a security issue? It's a minor risk, there are several conditions that would need to occur for someone to be able to retrieve sensitive information through a subdomain. As long as you run your webserver HTTPS only on the main domain and your activation link is not calling your website directly it should be fine.

The other option you have is to send the activation links from a seperate domain.

  • @Arminius oh, yea sure, I just need to check what the account is tagged to. – Lucas Kauffman Apr 2 '18 at 18:00
  • Thank you so much for clearing this up Lucas. You mention "this header should not be relevant to Mailgun unless I have included a subdomain that points to Mailgun", I do currently point to email.mg.mydomain.com. This in turn points to mailgun.org. So I can safely remove SECURE_HSTS_INCLUDE_SUBDOMAINS = env.bool( 'DJANGO_SECURE_HSTS_INCLUDE_SUBDOMAINS', default=True) ? – Sam Piecz Apr 2 '18 at 18:07
  • unless you have other subdomains running (e.g. www.yourdomain.com), yes. – Lucas Kauffman Apr 2 '18 at 18:09
  • @Arminius done :) – Lucas Kauffman Apr 2 '18 at 18:12
  • Okay cool. I do currently have mydomain.com and www.mydomain.com set up so, I guess I will have to look into sending activation links from a separate domain. Thanks again. Have a good one Lucas. – Sam Piecz Apr 2 '18 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.