1

I'm attempting to get a redirect which is failing, and for some reason I can't think today. I have a vHost file within HTTPD that listens on standard port 80 and port 443. I'm attempting to redirect https://domain.com/(.*) to https://www.domain.com/$1 so that the URL remains intact.

My config is as follows:

ServerName www.domain.com
ServerAlias tempdomain.testdomain.co.uk
ServerAlias domain.com

My rerwrite rule I'm using is.

RewriteCond %{HTTP_HOST} ^domain\.com$
RewriteRule ^(.*)$ https://www.domain.com$1 [R=301,L]

I've also tried removing the \. and $ but nothing.. When I visit the url https://domain.com/secure.page?action=comp it doesn't redirect to https://www.domain.com/secure.page?action=comp I do also have other SSL pages, the above was just an example..

Can anyone point out my stupidity.

1
  • Hi there, is Mod rewrite loaded?
    – hookenz
    Jan 24, 2011 at 22:24

5 Answers 5

2

I can't see anything wrong with your rewrite rule. Are you sure :

RewriteEngine on 

has been specified and this config is definitely being executed? Is it in a .htaccess file?

Try setting up a rewrite log it can help:

http://www.latenightpc.com/blog/archives/2007/09/05/a-couple-ways-to-debug-mod_rewrite

1
  • Rewrite is defined. The rules are specified within a vhost config file, found under /etc/httpd/conf/vhosts which is a directory defined within my HTTPD.conf Jan 11, 2011 at 10:57
2

In addition to using a rewrite, please enable HTTP Strict Transport Security. It's easy, and helps to defend against man-in-the-middle attacks on your visitors.

# load module (example using [RHEL])
LoadModule headers_module modules/mod_headers.so

# Use HTTP Strict Transport Security to force client to use secure connections only
Header set Strict-Transport-Security "max-age=86400"
Header append Strict-Transport-Security includeSubDomains

http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

2
  • Hi Blueben, My load balancer handles the SSL termination, and as such I don't require these modules, but thank you for the heads up. Jan 12, 2011 at 9:20
  • 1
    This isn't for the SSL site. This is for your HTTP site. It tells client browsers to remember that they should use HTTPS rather than HTTP for the next 86400 seconds. This will ensure that clients don't hammer on the redirect over and over, improving your site performance and the clients' security.
    – blueben
    Jan 12, 2011 at 9:26
1

this is all you need

RewriteCond %{HTTP_HOST} ^domain\.com
RewriteRule ^(.*)$ https://www.domain.com$1 [R=permanent,L]

this rule definitely works for me in Apache 2.2

0

I think that you are missing the "RewriteEngine On" line in your configuration, Here is an examle of how it shold all look like:

ServerName www.domain.com
ServerAlias tempdomain.testdomain.co.uk
ServerAlias domain.com 

RewriteEngine On
RewriteRule /.* https://www.domain.com/ [R]

Thanks and hope it works, RayQuang

3
  • Hi RayQuang, At the top of my file, I do have the RewriteEngine On already listed. Other rewrites work. Sorry I should have made my initial post more clearer Jan 11, 2011 at 10:56
  • Then I would advise to use some kind of redirect in the webpage itself, possibly using the PHP header function to redirect the user.
    – RayQuang
    Jan 11, 2011 at 11:46
  • Hi RayQuang,I can't use PHP, the solution is JAVA, so only HTTPD and Tomcat exist Jan 12, 2011 at 9:19
0

Try enabling the RewriteLog and see if that shows what the error is. In your httpd.conf file (or in your <VirtualHost> directive) add the following:

RewriteLog "/path/to/some/file.log"
RewriteLogLevel 9

DO NOT KEEP THIS LIKE THAT!!!!!! RewriteLogLevel 9 is very slow so it should not be used like that in production, just for testing. But enable that (and reload Apache of course) and check the log file to see what happens when you go to https://domain.com/secure.page?action=comp.

If you're still not sure of the problem, edit your question and post the relevant parts of the rewritelog.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.