3

I noticed that there are some articles on the Internet that talk about using the apache mod_rewrite module to rewrite a client to server http connection to https.

But rewrite does all the changes server side and are invisible to the client. Since the connection between client and server isn't something that happens only on the server, then does that mean that all http to https "rewrites" are actually redirects?

1
  • 1
    A redirect is required because of the protocol change. A rewrite cannot work in this case because the header response would ultimately be HTTP and not HTTPS. Cheers!!
    – closetnoc
    Mar 5, 2016 at 4:18

2 Answers 2

3

...does that mean that all http to https "rewrites" are actually redirects?

Yes. They are external redirects, not internal rewrites.

But rewrite does all the changes server side and are invisible to the client.

Yes, most would agree that a "rewrite" is internal to the server. And a "redirect" is external. Unfortunately, these two terms are often interchanged (even in "official" documents), which can be confusing. Sometimes they will be qualified, eg. "internal redirect" (which is not uncommon in the Apache docs).

Apache mod_rewrite handles both rewrites and redirects. mod_rewrite is required (as opposed to a mod_alias Redirect) because it allows you to check for HTTP and HTTPS requests.

1

But rewrite does all the changes server side and are invisible to the client.

You might be thinking of apache as a middle-man proxy client requesting a resource at a different URL, or maybe you have an application that is handling the redirect.

In at least 99% of website setups when a redirect is supposed to happen from page to page, the first page outputs headers and text that represent a redirect. Normally the status code outputted is 301. For example, the following data could be outputted to a client browser from apache when the first page is requested:

HTTP/1.1 301 Moved Permanently
Date: Fri, 04 Mar 2016 22:07:55 GMT
Server: Apache
Location: http://example.com/new/url
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://example.com/new/url">here</a>.</p>
</body></html>

I'd personally recommend against any sort of internal redirection especially if it's chained as it can dramatically increase the TTFB (time to first byte) of a page to load which in turn can lower rankings in search engines, simply because google loves speedy websites.

I'd suggest inventing a simple one-step redirect from your HTTP version of your page to HTTPS version. When you have done it right, then when someone requests the HTTP version, the client's browser will receive data similar to what I have shown above but the location will start with HTTPS instead of HTTP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.