I hope I'm asking in the right area.

Here's what I have. Apache 2.4.18 on Ubuntu 16.04 server.

I have my main website in a vhost, call it domain.com. This is proxied through CloudFlare.

I also have a vhost for manage.domain.com which listens on 80 and 443. This is also proxied through CloudFlare and I have a .htaccess file in the root of the directory containing:

RewriteEngine On
RewriteCond %{HTTP:CF-Visitor} '"scheme":"http"'
RewriteRule ^(.*)$ https://manage.domain.com/$1 [R=301,L]

The goal being that any visitors to this page get forced to HTTPS. Under this vhost, I have a directory "audit". This is gated by basic auth and also (attempting to) forced SSL. This is the current version of my .htaccess file under /audit/:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:CF-Visitor} '"scheme":"http"'
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

AuthType Basic
AuthName "Authorized Access Only"
AuthUserFile /etc/apache2/.htpasswd
Require user myuser

The current behavior is that manage.domain.com redirects to HTTPS as desired, but when I go to manage.domain.com/audit/, I'm prompted for auth but in HTTP, not HTTPS. I want forced HTTPS for all things related to manage.domain.com.

I've spent the last ~2 hours Googling and all the answers out there (that reportedly work for other people) result in 1 of 3 results:

  1. Too many redirects
  2. Successful access to manage.domain.com/audit/ without auth - EEK!
  3. Redirected back to my main website, domain.com

The only thing I can think of is that the CloudFlare proxy is involved and conflicting with my .htaccess redirects. So is there a way to do what I want? Simply force redirect to HTTPS and then prompt for auth.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.