Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On an apache 2.2 server running varnish, I am trying to redirect http -> to https for an entire Drupal Commons ( site.

Since varnish caches some redirects (R=301, but not R=302, I think), I first got my redirect working at :8080 which is not served by varnish.

The below .htaccess code successfully redirects http:// to https:// (Works in Chrome, FF and Safari.)

# RewriteBase /

### Standard Drupal7 .htaccess above here  ###

RewriteCond %{SERVER_PORT} ^8080$
RewriteRule ^(.*)$$1 [NC,R=302,L]

### Standard Drupal7 .htaccess below here  ###

# Rewrite URLs of the form 'x' to the form 'index.php?q=x'.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !=/favicon.ico
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

If I

  1. Change 8080 in the above to 80
  2. save .htaccess
  3. restart varnish
  4. clear the Drupal cache
  5. clear the browser cache
  6. visit http://

(I religiously did the above after every edit to .htaccess.)

I get a redirect loop in Chrome, FF, Safari when I visit http://

In an effort to understand the loop I changed the redirect as follows:

RewriteCond %{SERVER_PORT} ^80$
RewriteRule ^(.*)$$1/%{SERVER_PORT} [NC,R=302,L]

and I got this in my location bar: https://

When the browser is forwarded to the https url, shouldn't SERVER_PORT=443???

Changing to R=301 results in the same loop.

Testing %{HTTPS} results in the same loop.

#RewriteCond %{SERVER_PORT} ^80$
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$$1/%{HTTPS} [NC,R=301,L]

now I get this in my location bar: https://

Per (and I also tried:

RewriteCond %{SERVER_PORT} ^80$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$$1/%{SERVER_PORT} [NC,R=301,L]

Tried with and without the ! negation of -f and -d. Either way, the condition does not match so nothing happens. I don't know why these -f, -d tests would be needed....

I also tried removing the regular expression replacement in the RewriteRule

RewriteCond %{SERVER_PORT} ^80$
RewriteRule ^.*$ [R=301,L]

this still results in a loop.

Any help would be much appreciated.

share|improve this question
Does the connection successfully encrypt after the first redirect? This is... strange. Set a RewriteLog file and RewriteLogLevel 9? – Shane Madden Jan 6 '12 at 3:52

I found out from the server admins that they terminate SSL with Pound on this server. What that means is that SSL works, but the HTTP_SERVER variables do not reflect the values that I expected. SERVER_PORT will always be 80 and HTTPS will always be off regardless of the true state of things.

When using mod_rewrite, dump out your server variables to see what you can test with your RewriteCond's. See

You can also redirect http to https using most programming languages. I have Drupal's 443session module working with this site--it uses that approach. (I didn't have to tell the module to set up rules even though it couldn't detect that HTTPS was on.)

Make sure you use secure session cookies too. You need them in addition to mod_ssl to prevent session hijacking.

For Drupal this is old, but good I think is the best module option currently.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.