Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm attempting to get a redirect which is failing, and for some reason I can't think today. I have a vHost file within HTTPD that listens on standard port 80 and port 443. I'm attempting to redirect https://domain.com/(.*) to https://www.domain.com/$1 so that the URL remains intact.

My config is as follows:

ServerName www.domain.com
ServerAlias tempdomain.testdomain.co.uk
ServerAlias domain.com

My rerwrite rule I'm using is.

RewriteCond %{HTTP_HOST} ^domain\.com$
RewriteRule ^(.*)$ https://www.domain.com$1 [R=301,L]

I've also tried removing the \. and $ but nothing.. When I visit the url https://domain.com/secure.page?action=comp it doesn't redirect to https://www.domain.com/secure.page?action=comp I do also have other SSL pages, the above was just an example..

Can anyone point out my stupidity.

share|improve this question
    
Hi there, is Mod rewrite loaded? –  Matt Jan 24 '11 at 22:24

5 Answers 5

I can't see anything wrong with your rewrite rule. Are you sure :

RewriteEngine on 

has been specified and this config is definitely being executed? Is it in a .htaccess file?

Try setting up a rewrite log it can help:

http://www.latenightpc.com/blog/archives/2007/09/05/a-couple-ways-to-debug-mod_rewrite

share|improve this answer
    
Rewrite is defined. The rules are specified within a vhost config file, found under /etc/httpd/conf/vhosts which is a directory defined within my HTTPD.conf –  The NinjaSysadmin Jan 11 '11 at 10:57

In addition to using a rewrite, please enable HTTP Strict Transport Security. It's easy, and helps to defend against man-in-the-middle attacks on your visitors.

# load module (example using [RHEL])
LoadModule headers_module modules/mod_headers.so

# Use HTTP Strict Transport Security to force client to use secure connections only
Header set Strict-Transport-Security "max-age=86400"
Header append Strict-Transport-Security includeSubDomains

http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

share|improve this answer
    
Hi Blueben, My load balancer handles the SSL termination, and as such I don't require these modules, but thank you for the heads up. –  The NinjaSysadmin Jan 12 '11 at 9:20
    
This isn't for the SSL site. This is for your HTTP site. It tells client browsers to remember that they should use HTTPS rather than HTTP for the next 86400 seconds. This will ensure that clients don't hammer on the redirect over and over, improving your site performance and the clients' security. –  blueben Jan 12 '11 at 9:26

this is all you need

RewriteCond %{HTTP_HOST} ^domain\.com
RewriteRule ^(.*)$ https://www.domain.com$1 [R=permanent,L]

this rule definitely works for me in Apache 2.2

share|improve this answer

I think that you are missing the "RewriteEngine On" line in your configuration, Here is an examle of how it shold all look like:

ServerName www.domain.com
ServerAlias tempdomain.testdomain.co.uk
ServerAlias domain.com 

RewriteEngine On
RewriteRule /.* https://www.domain.com/ [R]

Thanks and hope it works, RayQuang

share|improve this answer
    
Hi RayQuang, At the top of my file, I do have the RewriteEngine On already listed. Other rewrites work. Sorry I should have made my initial post more clearer –  The NinjaSysadmin Jan 11 '11 at 10:56
    
Then I would advise to use some kind of redirect in the webpage itself, possibly using the PHP header function to redirect the user. –  RayQuang Jan 11 '11 at 11:46
    
Hi RayQuang,I can't use PHP, the solution is JAVA, so only HTTPD and Tomcat exist –  The NinjaSysadmin Jan 12 '11 at 9:19

Try enabling the RewriteLog and see if that shows what the error is. In your httpd.conf file (or in your <VirtualHost> directive) add the following:

RewriteLog "/path/to/some/file.log"
RewriteLogLevel 9

DO NOT KEEP THIS LIKE THAT!!!!!! RewriteLogLevel 9 is very slow so it should not be used like that in production, just for testing. But enable that (and reload Apache of course) and check the log file to see what happens when you go to https://domain.com/secure.page?action=comp.

If you're still not sure of the problem, edit your question and post the relevant parts of the rewritelog.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.