I have an apache server under a proxy that can run HTTPS. Instead of sending the HTTPS=on header, it sends HTTP_X_FORWARDED_PROTO=https.

I want to write an .htaccess rule that redirects all requests from https to http unless the URL is /user/login.

What I've come up with is around these lines (which does an infinite loop):

RewriteCond %{HTTP:http_x_forwarded_proto} !http
RewriteRule ^ http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

The problem with your redirect rule is probably that you're duplicating the "http_" prefix. This shouldn't be necessary. If you have a reverse proxy infront of your server (such as an F5 or nginx), the header will be "X-Forwarded-Proto", or some times "X-Forwarded_Proto". To reference these in a rewrite rule, use %{HTTP:Name-Of-Header} (case is not sensitive).

For the most robust rewrite that works in all situations, use something like this:

# Make sure all SSL pages for dot-com are redirected to HTTP.
RewriteCond %{SERVER_PORT} 443 [OR]
RewriteCond %{HTTPS} on [OR]
RewriteCond %{HTTP:X-Forwarded-Proto} https [OR]
RewriteCond %{HTTP:X-Forwarded_Proto} https
RewriteRule (.*) http://%{HTTP_HOST}/$1 [R=301,L]

Some more detail about using headers in RewriteCond is given in the Apache mod_rewrite documentation.


I think the problem with your initial condition is that you have !http instead of !=http. That may fix the infinite loop.

    RewriteEngine On
    RewriteCond %{HTTP:http_x_forwarded_proto} !=http
    RewriteCond %{REQUEST_URI} !^/user/login.*
    RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This should take any https request that is not /user/login and rewrite it to http. I'm sure there is a more elegant way to do this, though. You could get rid of RewriteCond %{HTTP:http_x_forwarded_proto} !=http and it would probably work just as well, for example, since it should take any request handed to it that does not include /user/login and redirect it to http.

  • Doesn't work either. I've opted for a redirect from my application for now, because I needed something fast, but I'd still be open for a htaccess redirect if it's possible. – Eduard Luca Oct 26 '12 at 0:33

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.