Django doesn't recognize HTTPS to set protocol correctly in emails

Description

When creating my own instance of codabench, Django doesn't recognizes the right domain protocol. It recognizes it as “http” instead of “https" even though "https" has been set up through Caddy and the website is served through "https."

In the account verification emails, where the link to verify account would show up as “http” instead of “https” even though the site is served through "https". This might also be a problem that manifests elsewhere.

To Reproduce

In def activateEmail(request, user, to_email) function in src/apps/profiles/views.py, protocol gets set to "http", even though the website has "https" in the URL. Below is the relevant part of the function with the code to set the protocol.

message = render_to_string('profiles/emails/template_activate_account.html', {
        'user': user.username,
        'domain': get_current_site(request).domain,
        'uid': urlsafe_base64_encode(force_bytes(user.pk)),
        'token': account_activation_token.make_token(user),
        'protocol': 'https' if request.is_secure() else 'http'
    })

When I print out 'https' if request.is_secure() else 'http' it says "http."

Potiential Fix

This is a fix that worked for me.

1. I added this to the .env file: USE_SSL=True
2. Uncommented the following code from src/settings/base.py file:

# TODO: Pull this, leaving in case django-oauth-toolkit problems
#========================================================================
# SSL
#========================================================================
if os.environ.get('USE_SSL')
   SECURE_SSL_REDIRECT = True
   SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
else:
   # Allows us to use with django-oauth-toolkit on localhost sans https
   SESSION_COOKIE_SECURE = False`

Start in src/apps/profiles/views.py at activateEmail(request, user, to_email), then inspect the SSL and proxy settings in src/settings/base.py. Reproduce account activation email generation behind Caddy and verify that HTTPS deployments produce HTTPS links while local non-HTTPS use remains supported.