Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to use mod_rewrite to ensure that certain pages are served with SSL and all others normally, but I am having trouble getting it to work

This works (redirect to SSL when request uri is for users or cart)

RewriteCond %{SERVER_PORT} 80 
RewriteCond %{REQUEST_URI} users [OR]
RewriteCond %{REQUEST_URI} cart
RewriteRule ^(.*)$ https://secure.host.tld/$1 [R,L]

So, to accomodate for a user not to keep browsing the site with ssl, when requesting other uris, I thought the below, but doesn't work: (when port is 443 and request uri is not one of uris that need to be served by ssl, redirect back to normal host)

RewriteCond %{SERVER_PORT} 443
RewriteCond %{REQUEST_URI} !^/users [OR]
RewriteCond %{REQUEST_URI} !group
RewriteRule ^/?(users|groups)(.*)$ http://host.tld/$1 [R,L]

Any help?

Thanks

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Your code:

RewriteCond %{SERVER_PORT} 443
RewriteCond %{REQUEST_URI} !^/users [OR]
RewriteCond %{REQUEST_URI} !group
RewriteRule ^/?(users|groups)(.*)$ http://host.tld/$1 [R,L]

If secure and not users or group... I think you want if secure and not users and not group. But, then you rewrite ONLY users and groups to http: which seems to be backwards from what you want.

So, you could do:

RewriteCond %{SERVER_PORT} 443
RewriteCond %{REQUEST_URI} !^/(users|group)
RewriteRule ^(.*)$ http://host.tld/$1 [R,L]

Since you have eliminated users/group in your rules, your rewrite rule would never see it.

However, rather than using SERVER_PORT, consider:

RewriteCond %{HTTPS} off

and

RewriteCond %{HTTPS} on

To make debugging a little easier,

RewriteLog /tmp/rewritelog
RewriteLogLevel 9

and watch that log file when you make requests and you can get a better idea of what is happening.

share|improve this answer
    
That worked great. Thanks a lot –  Thomas Mar 24 '10 at 13:50

This doesn't look like a particular good way of using SSL. There might be a way of messing with the get request to avoid this rewrite altogether. Why must you use rewrite to get this functionality.

maybe i'm wrong, but this code looks problematic.

SSL strip! http://www.youtube.com/watch?v=Dd5qGS-5C0I

share|improve this answer
    
Why would it be problematic? Serve certain pages with SSL and all others with normal http. –  Thomas Mar 20 '10 at 19:31
1  
+1 for the answer: I've seen way too many problems with mixed setups. You will find holes. They will be unexpected. No matter how many you've already plugged - seriously. –  Olaf Mar 23 '10 at 20:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.