1

I have a web server that has to meet PCI compliance requirements. Their latest round of policy changes have removed support for Safari, after having removed support for Windows XP based IE clients. The code below works great to send users of compliant browsers to the SSL site, but fails to identify Safari for some reason. PCI compliance says that we cannot use TLS 1.0 encryption, which is the highest encryption level Safari currently supports. Our non-SSL page displays a header informing the user of their issue and requesting that they upgrade to a more secure browser. 

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} !Version/[1-5] [OR]
RewriteCond %{HTTP_USER_AGENT} !MSIE\ ([6-8])
RewriteCond %{HTTP_HOST} sa\.edu [NC]
RewriteCond %{HTTP_HOST} www\.sa\.edu [NC]
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(.*) https://www.sa.edu/$1 [NC,R,L]

I've done a regex test on the Safari line and it works find in Regex. I've also looked at the different user agent strings used to see what the common thread is among Safari browsers. Version/[1-5] seems to be the common thread. I've also tried just hitting it with !Safari and that doesn't seem to catch them either, which should result in Chrome and Safari users as both pass a Safari string. Below is the user agent line of the Safari browser I'm test from and the Chrome browser I'm testing from.

Chrome:

Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36

Safari

Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/534.57.2 (KHTML, like Gecko) Version/5.1.7 Safari/534.57.2
Improve this question

2 Answers 2

Reset to default
1

Your logic appears to be reversed... you need to remove the OR flag at the end of the first RewriteCond directive. This looks like it should be an implicit AND:

RewriteCond %{HTTP_USER_AGENT} !Version/[1-5]
RewriteCond %{HTTP_USER_AGENT} !MSIE\ ([6-8])

In other words... if it's not Safari and it's not IE6-8 then proceed...

If you OR these two conditions then it's likely to always evaluate to true and you will always be redirected.

(I'm assuming your regex is correct.)

Improve this answer
3
  • Made the change, yes I do see my flaw in that logic now. But it still doesn't work. I tried doing an explicit check for just safari and dump them to another directory and using RewriteCond %{HTTP_USER_AGENT} Safari as the only condition won't pull safari over. Changing to Version won't either. I've tested for Chrome, Firefox, and IE and it works fine. It seems safari is just being a pain.
    – Shadowbranch
    Commented Aug 28, 2015 at 14:24
  • On the Safari browser you are testing, have you examined the user agent to make sure it is reported as expected? That would seem to be the only thing that could prevent this from working. (Mind you, an user can fake the user agent if they so wish.)
    – MrWhite
    Commented Aug 28, 2015 at 15:39
  • The line in my main comment is the user agent it passes as given to me by www.useragentstring.com so I would assume it's correct. I guess I will just kick on TLS 1.0 and deal with the PCI people since Safari devs can't seem to update.
    – Shadowbranch
    Commented Aug 28, 2015 at 15:55
0

You are almost there, the rewrite rule should be:

RewriteRule ^(.*)$ https://www.sa.edu/$1 [NC,L,R=301]

and the rewrite conditions for browser detection should be something like:

RewriteCond %{HTTP_USER_AGENT} !Version/[1-5]
RewriteCond %{HTTP_USER_AGENT} !MSIE\ ([6-8])
RewriteCond %{HTTP_USER_AGENT} !Trident #this actually detects all of the Internet Explorer versions
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.