Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to force a particular directory to require only allowed IPs and a valid username/password through basic authorization. To ensure that the username/password are sent in encrypted form, I want the directory to also force SSL use. Here is what I have in my .htaccess file:

# Force HTTPS-Connection
RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule (.*){REQUEST_URI} [R,L]

## password begin ##
AuthName     "Restricted Access"
AuthUserFile /var/www/admin/.htpasswd
AuthType     Basic
Require valid-user
Order deny,allow
Deny from all
Allow from
Satisfy All

Unfortunately, when I access that directory using http protocol, it is asking for the password before it redirects the page to the secure version. This means the password is sent unencrypted. What am I doing wrong? Is there a way to do this?

share|improve this question

Try putting SSLRequireSSL in your .htaccess file or the global Apache httpd configuration.

share|improve this answer

Rewrites and redirects are handled after autorisation. However: aliases in your httpd.conf are addressed first.

So what I did to get my http ://servername/webmail to https://webmail.servername was to put it in the httpd.conf like this:

<IfModule alias_module>
   Redirect permanent /webmail https://webmail.servername

The basic autorisation can stay in your .htaccess and will be executed just once AFTER the redirect was executed...

share|improve this answer

If you have access to the Apache config, add the authentication stanza to the VirtualHost that has SSL enabled. Then the redirect will always happen first.

Also, using mod_rewrite to perform a simple redirect is a bit of overkill. Use the Redirect directive instead. It's possible this may even fix your problem, as I believe mod_rewrite rules are some of the last directives to be processed, just before the file is actually grabbed from the filesystem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.