CODEWITHSUNDEEP
apachemod-rewrite
Timmy_
Timmy_

Reputation: 67

.htaccess require SSL for a particular URL

I want to force Apache to use HTTPS for a particular URL in the following form:

https://www.example.com/signup/*

so

if someone goes to any of the following example URLs directly, Apache will forward the URL over to the HTTPS equivalent site.

e.g.

http://www.example.com/signup  -->  https://www.example.com/signup
http://www.example.com/signup/basic+plan  -->  https://www.example.com/signup/basic+plan
http://www.example.com/signup/premium  -->  https://www.example.com/signup/premium

Anyone know how?

Thanks in advance

Upvotes: 1

Views: 8519

Answers (7)

RobbySherwood
RobbySherwood

Reputation: 361

.htaccess files are normally placed in a scope with Options -FollowSymLinks, which blocks Rewrite rules. This is often a security rule.

So a more trivial thing is often needed like this one:

<If "%{HTTPS} != 'on'">
  Redirect 301 /your/path https://www.example.com/your/path
</If>

This is a small enhancement to the answer of Greg Hewgill.

Upvotes: 0

Timmy_
Timmy_

Reputation: 67

Thank Murat,

Yours almost worked but figured out how to get it to exactly work.

The following is what works:

RewriteCond %{SERVER_PORT} 80 
RewriteCond %{REQUEST_URI} ^/somefolder/?
RewriteRule ^(.*)$ https://www.domain.com/$1 [R,L]

Notice that I didn't include somefolder in the www.domain.com rewriterule

Upvotes: 5

Jon Dean
Jon Dean

Reputation:

I used the following to require the checkout section of a website to require SSL:

<Directory "/var/www/html">
        RewriteEngine on
        Options +FollowSymLinks
        Order allow,deny
        Allow from all
        RewriteCond %{SERVER_PORT} !^443$
        RewriteRule \.(gif|jpg|jpeg|jpe|png|css|js)$ - [S=1]
        RewriteRule ^checkout(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
</Directory>

So for example, hitting http://www.example.com/checkout redirects to https://www.example.com/checkout

The rule will skip file extensions that are typically included within a page so that you don't get mixed content warnings. You should add to this list as necessary.

If you want multiple pages change the RewriteRule to something like:

RewriteRule ^(checkout|login)(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

Of course, the directory should match the actual path on your server. This page may also help with some more information for your specific needs: http://www.whoopis.com/howtos/apache-rewrite.html

I'm using this on a website that runs Plesk 8.6 but that shouldn't matter. This is in my vhost.conf file which is like putting it in your httpd.conf file. I'm not sure if you'd need to adjust anything to use it in a .htaccess file but I doubt it. If adding to a conf file don't forget to restart apache to reload the configuration.

If you are like me and want to use SSL only on particular pages then you also want a rewrite rule that sends you back to regular http for the rest. You can use the following for the reverse effect:

RewriteCond %{SERVER_PORT} ^443$
RewriteRule \.(gif|jpg|jpeg|jpe|png|css|js)$ - [S=1]
RewriteRule !^(checkout|login)(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [L,R]

If you are using Plesk like I am keep in mind that all non-SSL traffic uses the vhost.conf file but all SSL traffic uses the vhost_ssl.conf file. That means your first rewrite rule to require SSL would go in the vhost.conf file but the second rule to force back to non-SSL will have to go in the vhost_ssl file. If you are using httpd.conf or .htaccess I think you can put them both in the same place.

I've also posted this tutorial on my blog: Apache rewrite rules to force secure/non-secure pages.

Upvotes: 1

Murat Ayfer
Murat Ayfer

Reputation: 3914

I think this was what i used:

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80 
RewriteCond %{REQUEST_URI} ^/somefolder/?
RewriteRule ^(.*)$ https://www.domain.com/somefolder/$1 [R,L]

(from here)

Upvotes: 4

Bill B
Bill B

Reputation: 1300

You can do this with mod_rewrite -

RewriteCond %{SERVER_PORT} !^443$

RewriteRule ^/signup https://example.com/signup

RewriteRule ^/signup/(.*)$ https://example.com/signup/$1

Should work, though I haven't tested it.

-- edit --

Correction, I just tried this on one of my servers, and it works fine for me. You may want to doublecheck your mod_rewrite configuration. Also, if you're using .htaccess, you'll want to make sure overrides are allowed for that directory.

As a side note, this assumes your SSL traffic is coming over port 443. If it isn't, you'll need to adjust the rewrite condition accordingly.

Upvotes: 0

Greg Hewgill
Greg Hewgill

Reputation: 993085

You can use the Redirect directive:

Redirect 301 /signup https://www.example.com/signup

This will automatically preserve anything following /signup in the URL. Be sure to configure this directive only on your non-SSL site, or it might get into a recursive loop!

Upvotes: 3

hayalci
hayalci

Reputation: 4109

You should take a look at mod_rewrite documentation

Upvotes: 1

Related Questions