2

Part of my .htaccess file forces https on certain pages (e.g. when user logs in, enters credit card information, etc.) while forcing http on all other pages. This seems to be the ideal setup for what I need.

However, one of my site's extensions is responsible for generating a credit card processing form. In the form's action url, it has the https url of the web root in it (e.g. https://domain.com/). However, the web root is not one of those pages that the .htaccess forces https on, thus it's forcing a redirect to http. Because of this, the extension is failing because the form is attempting to submit to an https that redirects to http.

What should I do? I don't want users being forced to view a secured page when they don't have to; I'd rather they reap the benefits of caching. And obviously, on secured pages, they need to submit to secured URLs (my site's CMS apparently works in such a way that all form submissions to the web root works just fine). I can't tell the extension to submit to a different URL.

Here's the relevant part of my .htaccess:

<IfModule mod_rewrite.c>

   RewriteEngine On

   # Define default protocol for all assets
   RewriteRule ^ - [E=protocol:http,E=ssl:%{HTTPS}off]

   # Define HTTPS targets, add more cond as required
   RewriteCond $1 (payment|sign-in|sign-up) [NC]
   RewriteRule (.*) - [E=protocol:https,E=ssl:%{HTTPS}on]

   # Rewrite host if necessary and redirect on correct protocol
   RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
   RewriteRule ^ %{ENV:protocol}://%1%{REQUEST_URI} [L,R=301]

   # Protocol switch if necessary (host is already correct)
   RewriteCond %{ENV:ssl} ^(onoff|offon)
   RewriteCond %{REQUEST_URI} !\.(gif|jpe?g|png|css|js)$ [NC]
   RewriteRule ^ %{ENV:protocol}://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

   # Finally, process the internal redirect
   RewriteCond $1 !\.(gif|jpe?g|png)$ [NC]
   RewriteCond %{REQUEST_FILENAME} !-f
   RewriteCond %{REQUEST_FILENAME} !-d
   RewriteRule ^(.*)$ /index.php/$1 [L]

</IfModule>

Maybe this could be modified to "don't redirect if it's a form submission?"

3

In my opinion your optimizing the wrong thing by strictly forcing certain pages to use HTTPS and other to use plain HTTP. Simply redirect everything to HTTPS and be done with it.

The computational cost of HTTPS is negligible in most cases.
Your concern about browser cache with SSL seems unfounded as well.

And my pet peeve: you're better off including your configuration in the main httpd.conf instead of relying on .htaccess files, according to the manual.

  • 2
    +1, you beat me to it. I'm definitely a proponent of the 'encryption everywhere' ethos. But at the very least, respect the wishes of your end users if they want to use SSL, and don't force them unencrypted. So a happy medium is to force encryption where you need it, and do nothing where you don't. – Christopher Karel Jul 8 '14 at 14:14
  • I'm more of the opinion that the majority of users don't care either way and simply type the least and enter example.com in the address bar without any protocol specification leaving it to the site operator to upgrade to SSL. You have a point that making that more optional is not necessarily a bad thing, but the opposite, forcing users away from the TLS does seem like a bad idea. – HBruijn Jul 8 '14 at 14:24
  • @HBruijn - my concern about caching does not have to do with browser caching. I expect that to work with HTTPS. However, HTTPS won't work with public proxy caching, though -- right? I'm not concerned about the minuscule computational cost of HTTPS; I'm concerned about public proxy caching. And I agree with you about httpd.conf. – StackOverflowNewbie Jul 8 '14 at 18:54
  • @ChristopherKarel - "So a happy medium is to force encryption where you need it, and do nothing where you don't." <-- isn't that what I am doing already? – StackOverflowNewbie Jul 8 '14 at 18:55
  • Actually - I'm going to be using a CDN. Maybe public proxy server caching won't matter as much if my resources (style sheets, JS, images) are being served via CDN? – StackOverflowNewbie Jul 8 '14 at 19:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.