Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Ok, so I have two sites within the same webroot — the main site (in the root) and an unrelated bunch of files in a subdirectory. We would like both of these sites to force rendering under SSL.

At the moment, the relevant chunks of my httpd.conf read as follows:

<Directory "/var/www/html">
    <IfModule mod_rewrite.c>
        RewriteEngine on

        <IfModule mod_ssl.c>
            RewriteCond %{HTTPS} !=on
            RewriteRule ^subdir(.*)$ https://%{HTTP_HOST}/subdir$1 [R=301,L]

            RewriteCond %{HTTPS} !=on
            RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
        </IfModule>
    </IfModule>
</Directory>

<Directory "/var/www/html/subdir">
    <IfModule mod_rewrite.c>
        RewriteEngine on

        <IfModule mod_ssl.c>
            RewriteCond %{HTTPS} !=on
            RewriteRule ^subdir(.*)$ https://%{HTTP_HOST}/subdir$1 [R=301,L]

            RewriteCond %{HTTPS} !=on
            RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
        </IfModule>
    </IfModule>
</Directory>

but if a user browses directly to http://www.domain.com/subdir, they get redirected to the site root (https://www.domain.com/), discarding the rest of the request path. This is the case even if I remove the whole <IfModule mod_rewrite.c> section from the subdirectory's <Directory> section and is also the case if I remove the first RewriteCond/RewriteRule pair in each config section (which we only added to try to fix this problem).

I can't see why the first rule (in either <Directory> section) isn't taking effect first, so that the user is immediately redirected to https://www.domain.com/subdir (with SSL and subdir) before mod_rewrite even gets to the second rule (in either section).

I presume I'm doing something obviously wrong (not least because Apache configuration is not my core skillset), but I just can't see it. Looking at the mod_rewrite docs and the docs on How configuration sections are merged doesn't seem to answer my question either, unless I'm reading them wrong, so I'm at a complete loss.

Can anyone see the (probably obvious) mistake I'm making?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

Is the intent with the second RewriteRule under the subdir to send the user to the root, dropping the subdir path?

The context of the string passed to your source regex is dependent on the <Directory> context - so a request to /subdir/something.html will give the /var/www/html rules a string of subdir/something.html to match against, while the rules within /var/www/html/subdir will be matching against something.html.

You can use RewriteBase to override the context, so the config can be fixed to work as intended in one of two ways; using a RewriteBase:

<Directory "/var/www/html/subdir">
  <IfModule mod_rewrite.c>
    RewriteEngine on
    RewriteBase /
    # ... etc etc, no other changes needed

..or, by changing the destination URL to take the context into account (first rule will never match, as subdir isn't in the string):

<Directory "/var/www/html/subdir">
  <IfModule mod_rewrite.c>
    RewriteEngine on
    <IfModule mod_ssl.c>
      RewriteCond %{HTTPS} !=on
      RewriteRule ^(.*)$ https://%{HTTP_HOST}/subdir/$1 [R=301,L]
    </IfModule>
  </IfModule>
</Directory>
share|improve this answer
    
The intention is to redirect any HTTP path to the same path under SSL (so http://domain.com/ -> https://domain.com/ and http://domain.com/subdir/ -> https://domain.com/subdir/). So RewriteBase would "fix" that the first rule in the subdir is currently irrelevant, but also would solve that my problem seems to be the second rule, as you mention in your second example. Hopefully, that means I can give you a shiny green tick when I get to the office in the morning; thank you! ;o) –  Owen Blacker Feb 1 '12 at 21:19
    
That was exactly the problem I was having and your second example fixed it. Thank you, Shane! –  Owen Blacker Feb 2 '12 at 9:49
    
@OwenBlacker, for the reasons listed in this SO answer, I'd actually avoid this sort of redirections. –  Bruno Feb 3 '12 at 20:07
    
@Bruno That's actually a very good point, in cases of sites where the client system may send any kind of sensitive data - though POST parameters would be lost in the redirect, causing breakage in those cases, and sensitive session cookies could be set to secure-only.. but yeah, a better approach may be to only set the site or subdirectory's entry point (^/$ or ^/subdir/firstpage.html$) and 403 or 404 the rest. –  Shane Madden Feb 3 '12 at 21:11
    
Interesting, and I'd not thought of that. As it happens, on our site, it's very unlikely to be a problem (we'll be forcing users to come from specific known referrers and the whole site requires login, so it does mean that users are unlikely ever to suffer that problem. I might go and make that change on Monday nonetheless, in any case. Thank you both for pointing that out! –  Owen Blacker Feb 4 '12 at 0:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.