Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a tricky variation on an old problem.

I have an apache based site that should generally be accessed via http/port 80. However for certain areas protected areas that require authentication (designated by .htaccess), I want to be able to redirect the user the https/port 443.

The key here is that I want this to always happen for basic auth - i.e. I don't want to have to recreate each htaccess file with a redirect directive. I only want to enforce this for basic authentication (other traffic should be unencrypted). The protected areas are scattered all over the site. Is it possible to somehow redirect all basic authentication requests to the SSL host?

share|improve this question

3 Answers 3

I don't think it is possible to automatically redirect HTTP requests with Basic Authentication to a certain location - at least not with Apache httpd alone.

But you can use the SSLRequireSSL directive inside a Location block to force the clients to use HTTPS, otherwise they'll get an error 403.

share|improve this answer
    
Are there any apache modules or add-ons that might accomplish this? –  shreddd Mar 13 '10 at 19:17
    
Yeah, just add-on the required text in the virtual host configuration. :P –  David Rickman May 2 '10 at 8:59
up vote 1 down vote accepted

I finally figured out how this was being done on one of our servers (Ugly Hack alert).

We basically disallow .htaccess files in the stanza for the non-SSL (port 80) host. This generates a 500 error when it hits a .htaccess file.

We redirect all 500 errors to the SSL host where .htaccess files are allowed. "Real" 500 error messages will presumably fail on the SSL side as well, while the .htaccess related redirects are now functional on the SSL enabled side of things.

Yup - pretty ugly. I don't want to replicate this, but I figured I would pass this along.

share|improve this answer
    
Please mark this answer as accepted :) –  Adrian Lang Oct 18 '12 at 19:31

In an .htaccess file within the directory that is access with Basic Auth, put this :

SSLRequireSSL
ErrorDocument 403 /erreurs/403.php
ErrorDocument 401 /erreurs/401.php

This will redirect your visitors using http to the 401 or 403 errors pages.

In these page, put this :

<?php
$path = $SERVER['REQUEST_URI'];
if($_SERVER["HTTPS"] != "on")
{
header('HTTP/1.1 301 Moved Permanently');
header('Status: 301 Moved Permanently');
header('Cache-Control: max-age=31536000');
header('Content-Language: en');
header('Location: https://www.example.com/'.$path.'');
echo '<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"/><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="'.$path.'">here</a></p></body></html>';
}
else {
echo '<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"/><title>Forbidden</title></head><body><h1>Forbidden</h1><p>Forbidden</p></body></html>';
} ?>

The Basic Auth will be redirect to HTTPS.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.