redirecting all http to https

Fix it!!

redirecting all http to https

Postby new_to_mod_rewrite » Thu Mar 29, 2007 6:11 am

Hi
I have a subdomain set up (http://subdomain.domain.com) and i want all requests to this should be redirected to httpS://subdomain.domain.com. I tried the following:

Code: Select all
#
RewriteEngine on
RewriteCond %{SERVER_PORT} ^80$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
#


Now if I visit http://subdomain.domain.com, it shows me the page but without being redirected to httpS.

I also tried replacing the above condition with the following:
Code: Select all
RewriteCond %{SERVER_PORT} !^443$

No difference.

Another important thing. If I try to
Code: Select all
echo $_SEVER['SERVER_PORT']
on home page, and if I visit httpS://subdomain.domain.com/index.php or http://subdomain.domain.com/index.php, I always see 80. Even though I do see a "lock" symbol in the browser with httpS page.

Is there any other way to detect if the browser address is http so that it can be redirected to https?

Thanks.
new_to_mod_rewrite
 
Posts: 3
Joined: Thu Mar 29, 2007 6:01 am

Postby richardk » Fri Mar 30, 2007 12:11 pm

Try
Code: Select all
Options +FollowSymLinks

RewriteEngine On

# Not https://
RewriteCond %{HTTPS} ^off$ [NC]
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]


You can see the value using PHP with $_SERVER['HTTPS'].
richardk
 
Posts: 8800
Joined: Wed Dec 21, 2005 7:50 am

Postby new_to_mod_rewrite » Mon Apr 02, 2007 4:18 am

hi richard

thx for thr reply, but that doesn't work either. $_SERVER['HTTPS'] returns no value. phpinfo does not show any value for $_SERVER['HTTPS'].

i get the following, no matter whether i visit: http://subdomain.domain.com/index.php or httpS://subdomain.domain.com/index.php

--------
$_SERVER['SERVER_PROTOCOL'] output HTTP/1.1
$_SERVER['SERVER_PORT'] output 80
$_SERVER['HTTPS'] output "nothing"
--------

The only difference i see is if i try to output $_SERVER['REMOTE_ADDR']. if anyone visits http://, the person see's his (client machine's) ip as output. but if anyone visits https://, the person always sees 172.16.15.231 as output, no matter what his ip is. i can't understand why, and i don't know how to use this to solve my problem?

thx.
new_to_mod_rewrite
 
Posts: 3
Joined: Thu Mar 29, 2007 6:01 am

Postby richardk » Mon Apr 02, 2007 6:51 am

I seems that all SSL requests go to one server, and then the requests are proxied to the non-SSL servers inside the local network. You should be able to match that IP address to know if it's SSL or not.

Code: Select all
Options +FollowSymLinks

RewriteEngine On

# Not https://
RewriteCond %{REMOTE_ADDR} !^172\.16\.15\.231$ [NC]
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
richardk
 
Posts: 8800
Joined: Wed Dec 21, 2005 7:50 am

Postby new_to_mod_rewrite » Mon Apr 02, 2007 7:24 am

that seems to work. i will do few tests and reply back. thk u very much.
new_to_mod_rewrite
 
Posts: 3
Joined: Thu Mar 29, 2007 6:01 am


Return to Security with Mod_Rewrite

Who is online

Users browsing this forum: No registered users and 16 guests

cron