Apache redirect to https for basic auth

Question

I have a tricky variation on an old problem.

I have an apache based site that should generally be accessed via http/port 80. However for certain areas protected areas that require authentication (designated by .htaccess), I want to be able to redirect the user the https/port 443.

The key here is that I want this to always happen for basic auth - i.e. I don't want to have to recreate each htaccess file with a redirect directive. I only want to enforce this for basic authentication (other traffic should be unencrypted). The protected areas are scattered all over the site. Is it possible to somehow redirect all basic authentication requests to the SSL host?

Answer 1

I don't think it is possible to automatically redirect HTTP requests with Basic Authentication to a certain location - at least not with Apache httpd alone.

But you can use the SSLRequireSSL directive inside a Location block to force the clients to use HTTPS, otherwise they'll get an error 403.

Answer 2

I finally figured out how this was being done on one of our servers (Ugly Hack alert).

We basically disallow .htaccess files in the stanza for the non-SSL (port 80) host. This generates a 500 error when it hits a .htaccess file.

We redirect all 500 errors to the SSL host where .htaccess files are allowed. "Real" 500 error messages will presumably fail on the SSL side as well, while the .htaccess related redirects are now functional on the SSL enabled side of things.

Yup - pretty ugly. I don't want to replicate this, but I figured I would pass this along.