Trying to redirect a page to HTTPS using .htaccess, getting "too many redirects" error

Question

Ugh, seems like I'm having a lot of htaccess issues lately. Recently moved a client site to new hosting from the cient's internal server. Their IT had setup SSL and updated the .htaccess to redirect http://site.com/login to https://site.com/login. This .htaccess file causes a "too many redirects" error. I've done a lot of trial and error testing on this and the results are always the same. I even found Adding a .htaccess redirect to https that plays nicely with existing EE .htaccess rules and tried that exact working htaccess file and got the same results. Any ideas?

RewriteEngine On

# Remove trailing slashes
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)/$ /$1 [R=301,L]

# Redirect certain site pages to SSL and vice-versa
RewriteCond %{REQUEST_URI} !(login|themes|images|assets)
RewriteCond %{QUERY_STRING} !^(ACT=.*)$ [NC]
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

RewriteCond %{REQUEST_URI} (login)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

# Remove index.php from URLs
RewriteCond $1 !(^index\.php|(\.(gif|jpe?g|png|css|js)))$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

I've commented out everything but this and still have the same issue...

RewriteCond %{REQUEST_URI} (login)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

Answer 1

I've run into similar issues in the past, and honestly I gave up on htaccess in the end as I never could get it to work exactly as I intended.

A much easier solution I found was using an add on to force the redirect instead, doing it this way I gained direct control of pages needed redirecting in templates instead.

I used an addon called Force SSL, http://devot-ee.com/add-ons/force-ssl

You just pop {exp:force_ssl} in the page you want to be secured and your set. In my case I wanted some pages to not be secured too, so for that I just use {exp:force_ssl:restore}

Update:

Okay as it's still giving you the error when using other methods to redirect, this suggests to me there's something else causing the problems here. Just do this test for me. Remove all the ssl rules from htaccess, and also any occurrences of the Force SSL addon. Then goto any page on the site, but for SSL by putting https:// in the URL.

What I suspect is in this case it will redirect back to http:// from https://

If it does this then what's likely happening is there's something in the web server forcing insecure connections. This would be why you get too many redirects as it would just switch back and forth between the too hence the too many redirects error.

If it is this, just get in touch with your web host or whoever administers yoru server to get them to look into that as it's likely a config you don't have access too.

Answer 2

I've had similar issues; after discussion with our sys-admin, we determined that if you need anything on a site served with SSL (like a login page), you probably want the entire site served with SSL. Assuming everything you're serving on the front-end can be downloaded of HTTPS, that shouldn't be an issue. It adds some overhead, but, it's trivial, and doing so will prevent a few different attack vectors that you otherwise leave open when not securing the entire site.

In summary, turn on SSL for the whole site if you can. If that's not an option, I can throw a few minutes at your .htaccess file.