Researching .htaccess Syntax

Question

In my template .htaccess file I have been copying and pasteing alot of rules and researching .htaccess for around 2 weeks in an attempt to try and better understand the syntax, different modules & directives through MDN, stack-exchange & google. in the following example;

    <IfModule mod_rewrite.c>
        Options +FollowSymLinks
         RewriteEngine On
         RewriteCond %{HTTP_ACCEPT} image/webp
         RewriteCond %{DOCUMENT_ROOT}/$1.webp -f
         RewriteRule (.+)\.(jpe?g|png)$ $1.webp [T=image/webp,E=accept:1]
    </IfModule>

is there A HTTPS version of HTTP_ACCEPT image/webp? Or Will 'Upgrade Insecure Requests' Directive Already Catch this? This is not the only example of this I have come across there are alot of HTTP hard coded names & I'm wondering if their All insecure or if they will be updated as time goes by.

Answer 1

I think that your question may derive from a bit of a misunderstanding of what the HTTP_ACCEPT Apache server variable is... (?)

is there A HTTPS version of HTTP_ACCEPT image/webp?

No. It's the same variable; it's the same header. The HTTP_ACCEPT Apache server variable contains the value of the Accept HTTP request header as sent from the browser. This applies to both HTTP and HTTPS - which is the "same" protocol, same headers, etc. HTTPS is simply HTTP + SSL/TLS.

If you make a request over HTTPS then you still need to examine the same Accept HTTP request header.

All server variables that are named HTTP_<SOMETHING>, relate to the corresponding HTTP(S) request header.

Or Will 'Upgrade Insecure Requests' Directive Already Catch this?

Assuming you are referring to the Content Security Policy directive then kind of, in that compliant user-agents will automatically request resources over HTTPS rather than HTTP, but I'm not sure what you mean by "catch this"? CSP is not a replacement for an HTTP to HTTPS redirect.

I'm wondering if their All insecure or if they will be updated as time goes by.

There is nothing to be updated here. Whether the connection is secure or not is mostly transparent, the specifics of which have already occurred by the time your directives are processed in .htaccess.