1

On my development server, log in is with a certificate only (HTTPS on 443), While HTTP on 80 is redirecting to HTTPS. Without the redirect the ACCESS IS NOT RESTRICTED and everyone can go everywhere, because i can't do "require" on the HTTP and not HTTPS because "require" works only on LOCATION/FILE not on VHOST.

Can redirect be trusted to always deny access to HTTP? Is it secure enough?

Relevant settings:

At location /var/www/html/:

Require All granted
Options Indexes FollowSymLinks

At vhost [server ip]:80

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]

At vhost [server ip]:433

SSLVerifyClient require

1 Answer 1

1

Yes. If every request gets redirected, there's nothing else left. However, you are over-complicating things with your RewriteCond %{HTTPS} off. The HTTP VirtualHost could only have a single simple mod_alias Redirect for everything. When it doesn't even have any DocumentRoot it also becomes easier to realize it won't serve any content.

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent / https://example.com/
</VirtualHost>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .