Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We'd like to redirect all HTTPS traffic to HTTP except for a specific URL which is /user/login

So far we've got:

RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^user/login(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

But it's causing a redirect loop, when it redirects back to HTTP

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

I believe this should do the trick:

RewriteEngine On
RewriteBase /

# Turn SSL on for /user/login
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^/user/login
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

# Turn SSL off everything but /user/login
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^/user/login
RewriteRule ^(.*)$ http://%{HTTP_HOST}/$1 [R=301,L]

The above will do the following:

1. User types: https://yourdomain.com/user/login - no redirect
2. User types: http://yourdomain.com/user/login -> redirect to: https://yourdomain.com/user/login
3. User types: https://yourdomain.com/somerandomfile.php -> redirect to: http://yourdomain.com/somerandomfile.php
4. User types: http://yourdomain.com/somerandomfile.php - no redirect
share|improve this answer
add comment

Something like this should work:

RewriteEngine on
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !^/user/login
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R,L]

But this doesn't make much sense for me. It would be better if you redirect only requests to /user/login via SSL and leave everything else as it is:

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule /user/login(.*) https://%{HTTP_HOST}/user/login$1 [R,L]
share|improve this answer
    
Thanks. If we use HTTPS to serve the site then we lose the ability to cache pages with Varnish, so that's why I'd like to flip all HTTPS traffic back to HTTP except from the user login/account stuff, which we need to run over HTTPS –  Tom Sep 15 '11 at 10:37
    
This still appears to send anyone visiting example.com/user/login to example.com/user/login ? –  Tom Sep 15 '11 at 10:48
add comment

You are looking for redirect when the URI does not match with /user/login/?? here is the answer.

http://stackoverflow.com/questions/7084048/apache-redirect-regexp-match-something-that-is-not-following-something/7084117#7084117

share|improve this answer
    
Nope, that's not what I'm looking for –  Tom Sep 29 '11 at 9:15
    
talks about the same in your chosed as correct answer =) the key is the negation operator –  Felipe Alcacibar Oct 17 '11 at 18:01
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.