I hope I'm asking in the right area.
Here's what I have. Apache 2.4.18 on Ubuntu 16.04 server.
I have my main website in a vhost, call it domain.com. This is proxied through CloudFlare.
I also have a vhost for manage.domain.com which listens on 80 and 443. This is also proxied through CloudFlare and I have a .htaccess file in the root of the directory containing:
RewriteEngine On
RewriteCond %{HTTP:CF-Visitor} '"scheme":"http"'
RewriteRule ^(.*)$ https://manage.domain.com/$1 [R=301,L]
The goal being that any visitors to this page get forced to HTTPS. Under this vhost, I have a directory "audit". This is gated by basic auth and also (attempting to) forced SSL. This is the current version of my .htaccess file under /audit/:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:CF-Visitor} '"scheme":"http"'
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
AuthType Basic
AuthName "Authorized Access Only"
AuthUserFile /etc/apache2/.htpasswd
Require user myuser
The current behavior is that manage.domain.com redirects to HTTPS as desired, but when I go to manage.domain.com/audit/, I'm prompted for auth but in HTTP, not HTTPS. I want forced HTTPS for all things related to manage.domain.com.
I've spent the last ~2 hours Googling and all the answers out there (that reportedly work for other people) result in 1 of 3 results:
- Too many redirects
- Successful access to manage.domain.com/audit/ without auth - EEK!
- Redirected back to my main website, domain.com
The only thing I can think of is that the CloudFlare proxy is involved and conflicting with my .htaccess redirects. So is there a way to do what I want? Simply force redirect to HTTPS and then prompt for auth.
