3

I've got an extranet (mywebsite.com/extranet) and would like to make sure that just this section is always under https, even if the user types the URL without https in it. Likewise (as a bonus, if possible, and if it doesn't add an unnecessary overhead), I'd like to make sure that the rest of the website is always http, even the user types https.

How would I go about doing this in the following .htaccess file (I'd rather not change the existing rules if possible as they seem to work well on my existing servers)? I've tried various pieces of code after searching around, but I can't get anything to play nicely with the existing rules. Also, I'd rather not use any third party add-ons as I'd like to keep my EE install as lightweight as possible, thanks.

Here's my existing .htaccess code:

RewriteEngine On

# Remove trailing slashes
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)/$ /$1 [R=301,L]

# Add www
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

# Remove index.php from URLs
RewriteCond $1 !(^index\.php|(\.(gif|jpe?g|png|css|js)))$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]
3

The two chunks of code you require are:

# Redirect certain site pages to SSL and vice-versa
RewriteCond %{REQUEST_URI} !(extranet|themes|images|assets)
RewriteCond %{QUERY_STRING} !^(ACT=.*)$ [NC]
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

RewriteCond %{REQUEST_URI} (extranet)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

The first 4 lines force it to non-SSL, the last 4 lines force it to SSL. The important bit is the first line:

RewriteCond %{REQUEST_URI} !(extranet|themes|images|assets)

This lists the first segments of the URL that you don't want to change to http (from https). You need to include any URLs that will be on the extranet site - images, CSS and Javascript includes.

Some servers don't like RewriteCond %{HTTPS} !=on, so you may need to use the port number instead: RewriteCond %{SERVER_PORT} !^443$ - I've included it in the above but commented out just in case.

The order you place it in the .htaccess is important, based on my working version order and the code you supplied it would look like this:

RewriteEngine On

# Remove trailing slashes
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)/$ /$1 [R=301,L]

# Add www
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

# Redirect certain site pages to SSL and vice-versa
RewriteCond %{REQUEST_URI} !(extranet|themes|images|assets)
RewriteCond %{QUERY_STRING} !^(ACT=.*)$ [NC]
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

RewriteCond %{REQUEST_URI} (extranet)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

# Remove index.php from URLs
RewriteCond $1 !(^index\.php|(\.(gif|jpe?g|png|css|js)))$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]
2
  • Apologies for the belated reply to this one, and thanks for your help with this. :)
    – Stephen
    Apr 19 '13 at 0:25
  • I've finally gotten around to using this on a real site and it works great, so thanks again! :-)
    – Stephen
    Aug 26 '13 at 1:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.