up vote 6 down vote favorite
1
share [g+] share [fb]

I have a development site up that requires a username and password (basic http auth) before the user can see the site. I'd like to redirect to a secure protocol first, before the user can send in the password in clear text. Any thoughts on how to do this using Apache? I have access to the conf and .htaccess files.

The end results would be:

http://xxxx/ -- When user goes here, they get immediately redirected to https:

https -- When user gets here, they get prompted for username / password.

link|improve this question
feedback

4 Answers

up vote 3 down vote accepted

You can use the redirect directive on http virtualhost to redirect to the https site where authentification is done. You could also use mod_rewrite to do the redirection. The basic things is just to not set authentification on http virtualhost and redirect everything on the https virtualhost where authentication is done.

link|improve this answer
The issue is these are the same host, domains are the same. Is there a way in the .htaccess to say only apply the auth if https is set? – J.. Oct 16 '09 at 21:36
1  
Sadly this can only be done in a virtualhost, as apache doesn't provide a way to apply different configuration per request at the .htaccess level. You can use the different virtualhosts on different ports to do things differently. – David Pashley Oct 16 '09 at 22:36
Yes, you need to use 2 virtual host like <VirtualHost *:80> and <VirtualHost *:443> and not only one – radius Oct 16 '09 at 23:04
While I was hoping to be able to do this in .htaccess, looks like you guys are right, the only way is in the conf files, so I set it up to redirect http to https. Auth is still taken care of in the .htaccess, which is run only when accessing the https site now. Keeping auth in .htaccess has the benefit that if redirection fails for any reason, auth is still used. – J.. Oct 17 '09 at 17:37
feedback
up vote 5 down vote

Regardless of how you have the SSL vhost configured, I'd use this configuration for the non-SSL vhost:

<VirtualHost *:80>
    ServerName www.sitename.com
    ServerAlias sitename.com others-if-you-like.com
    ServerAdmin webmaster@sitename.com

    RedirectMatch ^/(.*)    https://www.sitename.com/$1 [L,R]

</VirtualHost>

Add lines for your logging, too, but nothing else is needed. Everything will be redirected permantently to the https:// URL, and the SSL site's .htaccess or other access control stuff won't be handled until after the redirect.

link|improve this answer
feedback
up vote 0 down vote

You can also see that blog entry here which explains how to do this with SSLRequireSSL, a custom ErrorDocument 403 directive which points to a perl script which redirects to the correct HTTPS url.

link|improve this answer
feedback
up vote -1 down vote

If I recall correctly, http basic authentication is done at the initial handshake before the SSL session is established. So even if you are logging into an SSL server the basic authentication is done in plaintext. That has been one of the longstanding issues with basic authentication. Perhaps one of the other http authentication methods deals with this. It's been a long time since I've looked at this.

link|improve this answer
1  
This is not true. HTTP Auth data is transmitted in the headers of the request, which is done after SSL negotiation. "Basic authentication across an SSL connection, however, will be secure, since everything is going to be encrypted, including the username and password." - httpd.apache.org/docs/1.3/howto/auth.html#basiccaveat – J.. Mar 7 '11 at 14:00
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.