Force SSL on some URLs but non-SSL on others with .htaccess

Question

I'd like to redirect requests for certain urls to secure https with .htaccess rules. I found this excellent tutorial:

https://exp-resso.com/blog/post/2011/08/securing-your-expressionengine-website-with-https

Based on this, I can redirect everything in the "account" template group, my system folder and the admin.php file with the following:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond $1 ^(account|system|admin\.php) [NC]
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] 

This works perfectly. But now I'm trying to find out how to do the opposite, redirect other URLs to non-secure http. I don't want to hard code navigation with http URLs. I'd rather use {path=''} and {site_url} variables.

Also, ideally it would work so that I don't have to hard-code all my non-secure template groups and pages into the .htaccess file.

RewriteCond $1 ^(about|contact|calendar|unicorns|etc) [NC]

This would be too hard to maintain.

Answer 1

After a lot of research and experimenting, I think I found a solution:

# Force non-SSL on these URLs
<IfModule mod_rewrite.c>
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond $1 !^(account|system|admin\.php)  [NC]
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

This rule checks if the request IS https, is not a form's POST action, isn't a file or directory that exists, and isn't one of the secure URLs (account, system, or admin.php). If all of those conditions are met, is redirect to non-secure http.

But for my homepage, www.example.com with no trailing URL segments, I had to write another rule.

# Force non-SSL on the homepage
<IfModule mod_rewrite.c>
RewriteCond %{HTTPS} on
RewriteCond %{QUERY_STRING} !^ACT= [NC]
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond $1 ^$  [NC]
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

I had to add a line to exclude ACTion ID URLs for things like Safecracker.

This solution seems to be working for me right now, but I'd love to hear any additional input. Either if I can streamline this or if I've overlooked something.

Update

As commenters have mentioned, using HTTPS everywhere is a better option. And it's most likely easier than jumping thru hoops with your htaccess rules.

Answer 2

Just throwing it out there but I've used this module before and it only requires a small tag in templates you want to serve via https. http://devot-ee.com/add-ons/dm-force-ssl

Answer 3

We've got this in a project where we wanted to exclude SSL for certain directories. We wanted it on the frontend, but not on the system & dashboard, where we were having issues with popups and custom fields:

RewriteCond %{ENV:SECURE_REDIRECT} != on
RewriteRule ^(system|dashboard) https://www.yourdomain.com%{REQUEST_URI} [NC,R=301]

Updated: That's specific to EngineHosting. Standard method is the following, which may still be more concise to exclude directories:

RewriteCond %{HTTPS} != on
RewriteRule ^(system|dashboard) https://www.yourdomain.com%{REQUEST_URI} [NC,R=301]