Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an apache server under a proxy that can run HTTPS. Instead of sending the HTTPS=on header, it sends HTTP_X_FORWARDED_PROTO=https.

I want to write an .htaccess rule that redirects all requests from https to http unless the URL is /user/login.

What I've come up with is around these lines (which does an infinite loop):

RewriteCond %{HTTP:http_x_forwarded_proto} !http
RewriteRule ^ http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
share|improve this question

2 Answers 2

The problem with your redirect rule is probably that you're duplicating the "http_" prefix. This shouldn't be necessary. If you have a reverse proxy infront of your server (such as an F5 or nginx), the header will be "X-Forwarded-Proto", or some times "X-Forwarded_Proto". To reference these in a rewrite rule, use %{HTTP:Name-Of-Header} (case is not sensitive).

For the most robust rewrite that works in all situations, use something like this:

# Make sure all SSL pages for dot-com are redirected to HTTP.
RewriteCond %{SERVER_PORT} 443 [OR]
RewriteCond %{HTTPS} on [OR]
RewriteCond %{HTTP:X-Forwarded-Proto} https [OR]
RewriteCond %{HTTP:X-Forwarded_Proto} https
RewriteRule (.*) http://%{HTTP_HOST}/$1 [R=301,L]

Some more detail about using headers in RewriteCond is given in the Apache mod_rewrite documentation.

share|improve this answer

I think the problem with your initial condition is that you have !http instead of !=http. That may fix the infinite loop.

    RewriteEngine On
    RewriteCond %{HTTP:http_x_forwarded_proto} !=http
    RewriteCond %{REQUEST_URI} !^/user/login.*
    RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This should take any https request that is not /user/login and rewrite it to http. I'm sure there is a more elegant way to do this, though. You could get rid of RewriteCond %{HTTP:http_x_forwarded_proto} !=http and it would probably work just as well, for example, since it should take any request handed to it that does not include /user/login and redirect it to http.

share|improve this answer
Doesn't work either. I've opted for a redirect from my application for now, because I needed something fast, but I'd still be open for a htaccess redirect if it's possible. – Eduard Luca Oct 26 '12 at 0:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.