3

I'm using Apache as a frontend for a RESTful service I'm building. All access to the service should come in over HTTPS, so I'd like Apache to respond to any HTTP access with a 403 message stating that secure access is required.

How would I configure Apache to do that?

<VirtualHost *:80>
        ServerName api.digiumcloud.net
        # Stuff to force 403 responses here
</VirtualHost>
  • Why not just redirecting to HTTPS? – ETL Feb 4 '14 at 16:09
  • 2
    For a web site, sure. But since it's an API, I don't want credentials/API keys/tokens/etc. being exposed in the initial HTTP request. If they don't use HTTPS, I don't want it to work at all. – leedm777 Feb 4 '14 at 17:47
2

I think you may be best by simply redirecting your users to HTTPS. But to do what you want, I think the following should work:

RewriteEngine on
RewriteRule /403-message.html - [L]
RewriteRule ^(.*)$ /403-message.html [L,R=403]
ErrorDocument 403 http://api.digiumcloud.net/403-message.html

Of course you have to make a 403-message.html file with what you want.

But to redirect to HTTPS:

RewriteEngine on
RewriteRule ^(.*)$ https://api.digiumcloud.net/$1 [L,R]
| improve this answer | |
  • That works well enough! I had to add RewriteRule /403-message.html - [L] before that RewriteRule to avoid and internal redirect loop. – leedm777 Feb 4 '14 at 18:02
  • @dave - good point. – ETL Feb 4 '14 at 18:59
1

Add SSLRequireSSL

It isn't HTTPS so it will always result in a Forbidden 403 Error

Redirecting HTTP to HTTPS using something like...

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule . https://%{SERVER_NAME}%{REQUEST_URI} [R,L]

Is the better solution, and does not hardcode the server or URI, preservice the URI as part of the redirection.

However you have to do this in the server configs, and not in ".htaccess".

If you used it in ".htaccess" with authentication, the authentication happens BEFORE the redirection (passwds get sent over HTTP in the clear).

The server configs do not have that problem as the HTTP and HTTPS directives can be placed in separate VHosts.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.