I am servicing some web pages over SSL.
The problem is that all the images, CSS and JS files are included on these pages using relatives paths (/images/save.png), thus the browser requests them on SSL. That's a bit of a waste.

Is there a way to configure Apache in order not to serve images, CSS and JS files over SSL, even if it is requested to?

  • 2
    Some browsers will pop-up a security warning dialogue if some elements of an HTTPS page are served with HTTP. – RedGrittyBrick Feb 15 '11 at 16:45
  • 1
    Advanced warning: most browser will through up an error if there is mixed secure/non-secure content. – Coops Feb 15 '11 at 16:55

I wouldn't recommend doing so since every client will receive a warning about the mixed ssl/non ssl content. But you asked:

RewriteEngine On
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !(\.js|\.css)$ [NC]
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI}


As @lekensteyn pointed out correctly, this is a not to underestimate waste of resources. Rewriting is not really performing well in that situation. Also the RewriteConditions have to be matched for each and every request to the files.

You will also need more open TCP Ports, which again produces overhead. And even if we don't go into detail that much there will be a significant overhead for having two protocols doing ones' job.

  • +1 for "Don't do that! (but here's how)" -- It's pretty much guaranteed that your users will get a big unfriendly WARNING box about mixed content (and if you sprang for an EV SSL certificate I believe this also keeps the URL bar from turning green)... – voretaq7 Feb 15 '11 at 16:56
  • 2
    I find a redirect more wasteful than serving images/js/css over HTTPS. If you really want these files to be served over an unencrypted channel, you'd better rewriting the URL's in your HTML files. – Lekensteyn Feb 15 '11 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.