1

In my template .htaccess file I have been copying and pasteing alot of rules and researching .htaccess for around 2 weeks in an attempt to try and better understand the syntax, different modules & directives through MDN, stack-exchange & google. in the following example;

    <IfModule mod_rewrite.c>
        Options +FollowSymLinks
         RewriteEngine On
         RewriteCond %{HTTP_ACCEPT} image/webp
         RewriteCond %{DOCUMENT_ROOT}/$1.webp -f
         RewriteRule (.+)\.(jpe?g|png)$ $1.webp [T=image/webp,E=accept:1]
    </IfModule>

is there A HTTPS version of HTTP_ACCEPT image/webp? Or Will 'Upgrade Insecure Requests' Directive Already Catch this? This is not the only example of this I have come across there are alot of HTTP hard coded names & I'm wondering if their All insecure or if they will be updated as time goes by.

2

I think that your question may derive from a bit of a misunderstanding of what the HTTP_ACCEPT Apache server variable is... (?)

is there A HTTPS version of HTTP_ACCEPT image/webp?

No. It's the same variable; it's the same header. The HTTP_ACCEPT Apache server variable contains the value of the Accept HTTP request header as sent from the browser. This applies to both HTTP and HTTPS - which is the "same" protocol, same headers, etc. HTTPS is simply HTTP + SSL/TLS.

If you make a request over HTTPS then you still need to examine the same Accept HTTP request header.

All server variables that are named HTTP_<SOMETHING>, relate to the corresponding HTTP(S) request header.

Or Will 'Upgrade Insecure Requests' Directive Already Catch this?

Assuming you are referring to the Content Security Policy directive then kind of, in that compliant user-agents will automatically request resources over HTTPS rather than HTTP, but I'm not sure what you mean by "catch this"? CSP is not a replacement for an HTTP to HTTPS redirect.

I'm wondering if their All insecure or if they will be updated as time goes by.

There is nothing to be updated here. Whether the connection is secure or not is mostly transparent, the specifics of which have already occurred by the time your directives are processed in .htaccess.

  • Thank you for clarifying, i just didn't know if these were some how legacy names & wondered about the security aspect of them. – Ryan Stone Jul 15 at 17:45
  • If you've used PHP then the same variable names (same values) exist in the $_SERVER superglobal. eg. $_SERVER['HTTP_ACCEPT']. Again, this exists (or not) regardless of whether the request is made over HTTP or HTTPS. – MrWhite Jul 15 at 22:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.