Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I wanted to allow access to www.mydomain.com/login through ssl only. E.g.: Whenever someone accessed http://www.mydomain.com/login, I wanted him to be redirect to https://www.mydomain.com/login so it's impossible for him/her to access that site without SSL.

I accomplished this by adding the following lines to the virtual host for www.mydomain.com on port 80 in /etc/apache2/sites-available/default:

RewriteEngine   on
RewriteCond     %{SERVER_PORT} ^80$
RewriteRule     ^/login(.*)$ https://%{SERVER_NAME}/login$1 [L,R]
RewriteLog      "/var/log/apache2/rewrite.log"

Now, I want to restrict using SSL for www.mydomain.com. That means, whenever someone accessed https://www.mydomain.com, I want him to be redirected to http://www.mydomain.com (for performance reasons).

I tried this by adding the following lines to the virtual host of www.mydomain.com on port 443 in /etc/apache2/sites-available/default-ssl:

RewriteEngine   on
RewriteCond     %{SERVER_PORT} ^443$
RewriteRule     ^/(.*)$ http://%{SERVER_NAME}/$1 [L,R]
RewriteLog      "/var/log/apache2/rewrite.log"

But when I now try to access www.mydomain.com/login, I get an error message that the server has caused to many redirects. That does make sense. Obviously, the two RewriteRules are playing ping-pong against each other.

How could I work around this?

share|improve this question
1  
What amount of performance boost do you expect to get from this? –  Lèse majesté Jan 27 '12 at 20:01
add comment

1 Answer

How about:

RewriteCond $1 ^(login) [NC]
RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1

RewriteCond $1 !^(login) [NC]
RewriteRule ^(.*)$ http://%{SERVER_NAME}/$1 [L]

I hope(!) that works - put it in .htacess or, if using vhosts, the first part goes in the normal vhost and the second bit goes in the ssl vhost.

No need to specify 80/443 to pattern match (LOGIN or login) in the URL and force to the SSL (or not if there is no match).

Okay, did not work

Added bit:

 RedirectMatch (?i)\/login https://www.example.com/login

In practice (depends on CMS) all your site links will be http anyway so you should only need the one RedirectMatch.

share|improve this answer
    
Hm, that didn't do the trick. The first Cond+Rule worked but the 2nd one doesn't work. http://www.mydomain.com/login won't be redirected to https://www.mydomain.com/login –  valmar Jun 1 '11 at 14:43
    
Sorry I haven't got a spare SSL site to test with right now. How about RedirectMatch? Just before your existing code for redirecting from https to http, try RedirectMatch - see updated answer... –  ʍǝɥʇɐɯ Jun 1 '11 at 15:02
    
Now, this is strange. I added the RedirectMatch to sites-available/default. When I go to http://www.mydomain.com/login, then I get first redirected to https://www.mydomain.com/login, then it jumps to http://www.mydomain.com//login and displays an error message that to many redirects occured. –  valmar Jun 1 '11 at 17:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.