htaccess, https, MSM, and Expresso Store

Question

I'm running EE multi-site manager (MSM).

1. My default site's domain (say, www.default.com) is where the /themes folder is housed.
2. So, for my second site (say, www.site-two.com), all of the EE and third-party theme files (js, css, etc) are being pull from www.default.com/themes/*
3. Site two is secure, using https (via .htaccess), since it's running Expresso's Store and requires SSL. Default site is not https.

My problem is that the requests to the EE and third-party theme files (from the default site) are not completing because they're being requested as https://www.default.com/themes/* instead of http://...

Here's my current .htaccess mod_rewrite section

RewriteEngine On

## -- force www -- ##
RewriteCond %{HTTP_HOST} ^site-two\.com$ [NC]
RewriteRule ^(.*)$ http://www.site-two.com/$1 [R=301,L]

## -- force https -- ##
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^www\.site-two\.com$  [NC]
RewriteRule .* https://www.site-two.com/%1%2  [R=301,L]

## -- remove index.php -- ##
RewriteCond $1 !\.(gif|jpe?g|png)$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php?/$1 [L]

I've tried endless .htaccess variations with no success. I don't even know if I'm wanting is possible. I'd like to avoid making www.default.com secured (more money), if possible.

NEW INFO PER ADRIAN'S FIRST ANSWER: Using Focus Lab's master config set up, I have this for the production config, which is why it at least pulling from the default site.

$env_config['default_url']      = 'http://www.default.com';
$env_config['theme_folder_url']     = $env_config['default_url'] . '/themes/';

Any help is greatly appreciated.

EDIT: Problem is this auto-generated script from the exp:store:checkout tag. See the script.src

if (!ExpressoStore.scriptElement) {
                var script = ExpressoStore.scriptElement = document.createElement("script");
                script.type = "text/javascript"; script.async = true;
                script.src = "//www.default.com/themes/third_party/store/store.js";
                (document.getElementsByTagName("head")[0] || document.getElementsByTagName("body")[0]).appendChild(script);
            }

Answer 1

This isn't really an issue with your htaccess. You need to look at using a simple EE config bootstrap file such as this one to automatically set $config['theme_folder_url'] as either HTTP or HTTPS depending on whether the current request is served over HTTPS.

In the most basic form, you could probably just add this to your config.php file:

if (empty($_SERVER['HTTPS']) || strtolower($_SERVER['HTTPS']) == 'off') {
    $config['theme_folder_url'] = 'http://www.example.com/themes';
} else {
    $config['theme_folder_url'] = 'https://www.example.com/themes';
}

Answer 2

That's because your .htaccess file is forcing them over a secure connection. Stepping backwards for a second do you really need ALL areas of the site to be run over a secure connection? Generally you only want the checkout and the account section to be sure as it involves sensitive form submissions. The rest of the site isn't really necessary.

So with that in mind how about changing your .htaccess file so that you only specify the URL segments you wish to protect:

# Redirect to HTTPS if not using HTTPS  
RewriteEngine On 
RewriteCond %{HTTPS} !=on
# Specify URL segments to ensure a secure connection 
RewriteCond $1 ^(member|account|checkout|system) [NC]
# Rewrite requests to above segments over HTTPS
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

So now instead of EVERY request being sent over HTTPS it will only send the segments you specify and should solve the problem.