5

I'd like to redirect requests for certain urls to secure https with .htaccess rules. I found this excellent tutorial:

https://exp-resso.com/blog/post/2011/08/securing-your-expressionengine-website-with-https

Based on this, I can redirect everything in the "account" template group, my system folder and the admin.php file with the following:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond $1 ^(account|system|admin\.php) [NC]
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] 

This works perfectly. But now I'm trying to find out how to do the opposite, redirect other URLs to non-secure http. I don't want to hard code navigation with http URLs. I'd rather use {path=''} and {site_url} variables.

Also, ideally it would work so that I don't have to hard-code all my non-secure template groups and pages into the .htaccess file.

RewriteCond $1 ^(about|contact|calendar|unicorns|etc) [NC]

This would be too hard to maintain.

5

After a lot of research and experimenting, I think I found a solution:

# Force non-SSL on these URLs
<IfModule mod_rewrite.c>
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond $1 !^(account|system|admin\.php)  [NC]
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

This rule checks if the request IS https, is not a form's POST action, isn't a file or directory that exists, and isn't one of the secure URLs (account, system, or admin.php). If all of those conditions are met, is redirect to non-secure http.

But for my homepage, www.example.com with no trailing URL segments, I had to write another rule.

# Force non-SSL on the homepage
<IfModule mod_rewrite.c>
RewriteCond %{HTTPS} on
RewriteCond %{QUERY_STRING} !^ACT= [NC]
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond $1 ^$  [NC]
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

I had to add a line to exclude ACTion ID URLs for things like Safecracker.

This solution seems to be working for me right now, but I'd love to hear any additional input. Either if I can streamline this or if I've overlooked something.

Update

As commenters have mentioned, using HTTPS everywhere is a better option. And it's most likely easier than jumping thru hoops with your htaccess rules.

| improve this answer | |
  • It looks like you're on the right track here. One thing I will say - it's a hell of a lot easier if you just make the whole site HTTPS, and it's a better look for your customers as well. – Adrian Macneil Feb 19 '13 at 10:06
  • I'd like to save on server overhead by not making everything https and speed up the users experience. Also, this site doesn't sell anything. No money transactions. Just user data being collected. What do you mean by "it's a better look?" – Alex Roper Feb 19 '13 at 10:18
  • 2
    Well if you don't sell anything it's not such a big deal. I meant for ecommerce sites customers will feel safer if your site makes their browser bar go green, and therefore it may very well increase your sales. The server overhead argument is extremely outdated, you will probably only save <1% of your server resources with non-HTTPS ssl.entrust.net/blog/?p=455 – Adrian Macneil Feb 20 '13 at 9:48
  • Oh, gotcha. Thanks for the tip about HTTPS resource usage! I'm probably over thinking things again. :) – Alex Roper Feb 21 '13 at 0:49
  • 1
    I'll second Adrian's comments. There are some things you can do to speed it up as well. ellislab.com/blog/entry/ssl-everywhere-at-ellislab – Derek Jones Dec 1 '14 at 22:21
2

Just throwing it out there but I've used this module before and it only requires a small tag in templates you want to serve via https. http://devot-ee.com/add-ons/dm-force-ssl

| improve this answer | |
  • I used a similar 'https_redirect' plugin with Cartthrob but had mixed results. Navigation and relative URLs would go to the wrong protocol sometimes. And then I would have problems with mixed SSL and non-SSL on the same page (images or stylesheets) and this would pop-up warnings in the browser. I'm glad to see DM Force SSL includes a tag to force non-SSL too. I'll have to try out this plugin. – Alex Roper Feb 19 '13 at 10:42
1

We've got this in a project where we wanted to exclude SSL for certain directories. We wanted it on the frontend, but not on the system & dashboard, where we were having issues with popups and custom fields:

RewriteCond %{ENV:SECURE_REDIRECT} != on
RewriteRule ^(system|dashboard) https://www.yourdomain.com%{REQUEST_URI} [NC,R=301]

Updated: That's specific to EngineHosting. Standard method is the following, which may still be more concise to exclude directories:

RewriteCond %{HTTPS} != on
RewriteRule ^(system|dashboard) https://www.yourdomain.com%{REQUEST_URI} [NC,R=301]
| improve this answer | |
  • From what I understand {ENV:SECURE_REDIRECT} is a custom environment variable set by EngineHosting, correct? – Alex Roper Feb 21 '13 at 0:52
  • "Note that %{ENV:SECURE_REDIRECT} is a custom environment variable set by EngineHosting. Due to the way their servers are set up, the normal %{HTTPS} variable doesn’t reflect the actual SSL status of the request. If you’re not on EngineHosting, use %{HTTPS} instead." (From Pixel & Tonic blog / Google search) – Mark J. Reeves Feb 21 '13 at 2:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.