Adding a .htaccess redirect to https that plays nicely with existing EE .htaccess rules

Question

I've got an extranet (mywebsite.com/extranet) and would like to make sure that just this section is always under https, even if the user types the URL without https in it. Likewise (as a bonus, if possible, and if it doesn't add an unnecessary overhead), I'd like to make sure that the rest of the website is always http, even the user types https.

How would I go about doing this in the following .htaccess file (I'd rather not change the existing rules if possible as they seem to work well on my existing servers)? I've tried various pieces of code after searching around, but I can't get anything to play nicely with the existing rules. Also, I'd rather not use any third party add-ons as I'd like to keep my EE install as lightweight as possible, thanks.

Here's my existing .htaccess code:

RewriteEngine On

# Remove trailing slashes
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)/$ /$1 [R=301,L]

# Add www
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

# Remove index.php from URLs
RewriteCond $1 !(^index\.php|(\.(gif|jpe?g|png|css|js)))$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

Answer 1

The two chunks of code you require are:

# Redirect certain site pages to SSL and vice-versa
RewriteCond %{REQUEST_URI} !(extranet|themes|images|assets)
RewriteCond %{QUERY_STRING} !^(ACT=.*)$ [NC]
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

RewriteCond %{REQUEST_URI} (extranet)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

The first 4 lines force it to non-SSL, the last 4 lines force it to SSL. The important bit is the first line:

RewriteCond %{REQUEST_URI} !(extranet|themes|images|assets)

This lists the first segments of the URL that you don't want to change to http (from https). You need to include any URLs that will be on the extranet site - images, CSS and Javascript includes.

Some servers don't like RewriteCond %{HTTPS} !=on, so you may need to use the port number instead: RewriteCond %{SERVER_PORT} !^443$ - I've included it in the above but commented out just in case.

The order you place it in the .htaccess is important, based on my working version order and the code you supplied it would look like this:

RewriteEngine On

# Remove trailing slashes
RewriteCond %{REQUEST_METHOD} !=POST
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.+)/$ /$1 [R=301,L]

# Add www
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

# Redirect certain site pages to SSL and vice-versa
RewriteCond %{REQUEST_URI} !(extranet|themes|images|assets)
RewriteCond %{QUERY_STRING} !^(ACT=.*)$ [NC]
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

RewriteCond %{REQUEST_URI} (extranet)
RewriteCond %{HTTPS} !=on
#RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

# Remove index.php from URLs
RewriteCond $1 !(^index\.php|(\.(gif|jpe?g|png|css|js)))$
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]