4

I have a website served by Apache 2.4 which should serve all contents via HTTPS. I already have appropriate redirections in place which work correctly, but don't catch any pathological case. I wanted to improve that situation, and, when doing my homework, came across the following example in this document:

<If "%{SERVER_PROTOCOL} != 'HTTPS'">
    Redirect "/admin/" "https://www.example.com/admin/"
</If>

I slightly modified this to reflect my situation:

<If "%{SERVER_PROTOCOL} != 'HTTPS'">
    Redirect "/" "https://www.example.com/"
</If>

Now, when trying to view any URL from my site, the browser goes into an infinite redirection loop.

I am suspecting that the example actually is wrong. SERVER_PROTOCOL does not seem to contain the value HTTPS under any circumstances. Instead, according to what I have read in other articles, it contains things like HTTP/1.1 (as the name would let expect).

So my question is: What exactly does SERVER_PROTOCOL contain under what circumstances / in what context? And what could be the reason that Apache's official documentation website is the only one I have found during several hours of research that lists HTTPS as a possible value of SERVER_PROTOCOL?

2
  • 1
    SERVER_PROTOCOL could be HTTP/1.0 (old browsers), HTTP/1.1 (most common nowadays), HTTP/0.9 (when ommited by the client, pretty old software or manual tests) and probably HTTP/2.0 at some point. It won't help you in your redirects for https. Also, if you are not going to use http under any circumstances, I would search for HSTS
    – NuTTyX
    Jan 22, 2017 at 21:40
  • Well, thank you very much and +1. Then the documentation is indeed wrong (I still can't believe that I'm the first one affected by that error). HSTS has been on my schedule anyway ...
    – Binarus
    Jan 22, 2017 at 22:18

1 Answer 1

4

Congratulations, you found an error in the Apache documentation. Consider reporting it.

As for your immediate problem, you appear to be looking for REQUEST_SCHEME, which will contain

The scheme part of the request's URI

for instance, http or https.

1
  • Thanks - accepted as answer and +1. I'll try to find out how to file the bug. Regarding the actual problem: I already had found the page you linked, but didn't take it serious because I couldn't believe that there is such an error in the documentation. Furthermore, I already had tried using the HTTPS variable which had lead to another problem. The same problem arose when using REQUEST_SCHEME (this is a matter for a separate question)..
    – Binarus
    Jan 22, 2017 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .