2

Ugh, seems like I'm having a lot of htaccess issues lately. Recently moved a client site to new hosting from the cient's internal server. Their IT had setup SSL and updated the .htaccess to redirect http://site.com/login to https://site.com/login. This .htaccess file causes a "too many redirects" error. I've done a lot of trial and error testing on this and the results are always the same. I even found Adding a .htaccess redirect to https that plays nicely with existing EE .htaccess rules and tried that exact working htaccess file and got the same results. Any ideas?

RewriteEngine On

# Remove trailing slashes
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)/$ /$1 [R=301,L]

# Redirect certain site pages to SSL and vice-versa
RewriteCond %{REQUEST_URI} !(login|themes|images|assets)
RewriteCond %{QUERY_STRING} !^(ACT=.*)$ [NC]
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

RewriteCond %{REQUEST_URI} (login)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

# Remove index.php from URLs
RewriteCond $1 !(^index\.php|(\.(gif|jpe?g|png|css|js)))$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

I've commented out everything but this and still have the same issue...

RewriteCond %{REQUEST_URI} (login)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]
3

I've run into similar issues in the past, and honestly I gave up on htaccess in the end as I never could get it to work exactly as I intended.

A much easier solution I found was using an add on to force the redirect instead, doing it this way I gained direct control of pages needed redirecting in templates instead.

I used an addon called Force SSL, http://devot-ee.com/add-ons/force-ssl

You just pop {exp:force_ssl} in the page you want to be secured and your set. In my case I wanted some pages to not be secured too, so for that I just use {exp:force_ssl:restore}

Update:

Okay as it's still giving you the error when using other methods to redirect, this suggests to me there's something else causing the problems here. Just do this test for me. Remove all the ssl rules from htaccess, and also any occurrences of the Force SSL addon. Then goto any page on the site, but for SSL by putting https:// in the URL.

What I suspect is in this case it will redirect back to http:// from https://

If it does this then what's likely happening is there's something in the web server forcing insecure connections. This would be why you get too many redirects as it would just switch back and forth between the too hence the too many redirects error.

If it is this, just get in touch with your web host or whoever administers yoru server to get them to look into that as it's likely a config you don't have access too.

| improve this answer | |
  • I gave the plugin a try and I get the same "too many redirects" error :/ – Mike Lohrman Oct 11 '13 at 20:38
  • Just updated my answer with a new idea – neekster Oct 12 '13 at 2:16
  • tried viewing a https page and it did not redirect to http. So things appear to be working there ok. Thanks for the idea. – Mike Lohrman Oct 14 '13 at 13:26
  • Another suggestion, just to eliminate anything EE from the picture, remove EE altogether by just doing the test with some static HTML files, redirecting to HTTPS etc on the static html. This will tell you if the issue lies solely on the underlying hosting configuration/htaccess or if something in your EE setup is contributing to the problem. – neekster Oct 16 '13 at 1:23
  • neekster, thanks for hanging in there with me! I uploaded a static html file and it works at both site.com/test.html and site.com/test.html. So it must be something to do with the htaccess and EE, probably both. I'm going to do some more trial and error testin with the htaccess file, even though I'm sure I tested the htaccess with everything commented out besides the ssl redirect and it still had problems. Thanks! – Mike Lohrman Oct 16 '13 at 13:24
0

I've had similar issues; after discussion with our sys-admin, we determined that if you need anything on a site served with SSL (like a login page), you probably want the entire site served with SSL. Assuming everything you're serving on the front-end can be downloaded of HTTPS, that shouldn't be an issue. It adds some overhead, but, it's trivial, and doing so will prevent a few different attack vectors that you otherwise leave open when not securing the entire site.

In summary, turn on SSL for the whole site if you can. If that's not an option, I can throw a few minutes at your .htaccess file.

| improve this answer | |
  • Nick, thanks for the response. I can ask the client how they feel about making the whole site secure. I will also have to check to make sure everything works correctly on the front end. That being said, is there anything you can see that would be causing this redirect issue? I updated my initial question to show the part that doesn't work. Thanks for any info. – Mike Lohrman Oct 16 '13 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.