Middleware ordering hints don't mention SecurityMiddleware

[Taymon A. Beal]

The documentation offers ​hints on how to order different middleware classes, but doesn't say anything about where one should put SecurityMiddleware relative to the other classes. The default project template puts it at the bottom, but the old django-secure documentation suggests putting it near the top.

[Carl Meyer]

Tim, do you recall why you put it at the bottom of the list when you did the integration?

I think I recommended top of the list in the django-secure docs just because I figured if you're going to turn on the redirect-to-HTTPS, it may as well happen sooner rather than after running through a bunch of other unnecessary middleware.

Trying to think what the reasoning would be for having it at the bottom of the list: I guess if you had other middleware that wanted to access the value of some headers set by SecurityMiddleware?

Mostly I think it just really doesn't matter very much where you put it, unless you're in an unusual situation.

[Tim Graham]

I don't recall putting any thought into its position in the list.

[Yamila]

Hi! I would like to help here, but I'm not sure what's the decission. As far as I see:

• This middleware is not documented in the "ordering middleware" part. Should be?
• This middleware appears in a different possition than older versions. It would'n affect the documentation, and ¿maybe? is another ticket.

I guess the documentation should follow the code, and I'm not sure if it's going to be changed.

[Carl Meyer]

I don't have strong feelings about this, but if we're going to clarify the situation, the only reasoning I have for putting it anywhere is what I mentioned; that it should go near the top of the list if you're using the SSL redirect, for efficiency. So my inclination would be to a) mention that in the docs, and b) change the startproject template to move it up top, just so we're following our own advice.

[MZ]

Fixed the ticket
​https://github.com/django/django/pull/4814

[Carl Meyer]

I think the docs addition sentence could probably be reworded slightly for better flow, but that can be handled by whoever merges - I think this patch is basically ready to go. Thanks for the pull request!

[Tim Graham <timograham@…>]

In 8b1f39a7:

Fixed #24796 -- Added a hint on placement of SecurityMiddleware in MIDDLEWARE_CLASSES.

Also moved it in the project template.

[Ed Morley]

I don't suppose this could be backported to 1.8? (or at least just the docs part)

The current 1.8 docs caused some confusion in:
​https://github.com/evansd/whitenoise/issues/100

Thanks :-)

[Tim Graham <timograham@…>]

In 358ae4a:

[1.8.x] Fixed #24796 -- Moved SecurityMiddleware in MIDDLEWARE_CLASSES docs.

Partial backport of 8b1f39a727be91aab40bdb37235718ed63ae1d50 from master