I am curious to find out how people are doing site wide https with links and forms. I am familiar with URL::secure for generating a form link. It looks like you can pass https to a route to force https. Does this mean I have to set https on every route definition?
Why don't you do it using your web server? I think it's safer and you don't have to do anything else on your application.
This is my configuration for apache:
<IfModule mod_rewrite.c>
#Options -MultiViews
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php?/$1 [L]
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://domain.com/$1 [R,L]
</IfModule>
Related
I'm struggling to get my .htaccess configured properly to setup a subdomain redirect for specific subdomains. I want to redirect (not mask) a subdomain to a specific page and repeat this configuration multiple times.
I'm hosted on a Google Compute Engine currently using Cloud DNS (used to host on Godaddy in which subdomain management was very simple)
before:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
after:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^sat.theteachertutors.com$ [NC]
RewriteRule ^(.*)$ /private-sat-act-tutoring/$1 [L]
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
I tried the config above but the redirect does not work. The target url is: https://www.theteachertutors.com/private-sat-act-tutoring/
Any guidance/tips would be most appreciated. I've search for other examples but can't get this configuration to work at all, ie: http://sat.theteachertutors.com
Thanks
You were close to the solution, change the rewrite rule to this:
RewriteRule ^(.*)$ https://www.theteachertutors.com/private-sat-act-tutoring/$1 [R=301,L]
When you are redirecting to another domain/subdomain you have to use the full URL. Also I use R=301 to mark the redirect as a permanent redirect (by default rules that point to another domain use a 302 redirect).
I just bought an SSL cert for my site and I am trying to force HTTPS. It kinda works but not really. I am on Apache using PHP Slim framework for custom routing.
My folder struct
root/
.htaccess (A)
php/
public_html/
.htaccess (B)
.htaccess (A)
My main htaccess file has these rules
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]
When I go to example.com it goes to the secure page. Great!
.htaccess (B)
My public_html file has these rules
<IfModule mod_rewrite.c>
RewriteEngine on
#RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule . index.php [QSA,L]
</IfModule>
# Always use https for secure connections
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]
Problem:
If I go to http://www.example.com/login,
instead of redirected to https://www.example.com/login,
it redirects to https://www.example.com/index.php
Rules in htaccess-files get's validate from top to bottom. In your htaccess, it first check if the requested resource (/login) exists on the server or not. If it doesn't, it redirects the request to index.php.
It should work if you simply moved the https-check/redirect before the other rule.
<IfModule mod_rewrite.c>
RewriteEngine on
#RewriteBase /
# Always use https for secure connections
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R=301,L]
# Redirect requests to non existing resources to index.php
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule . index.php [QSA,L]
</IfModule>
I also removed the second RewriteEngine On. Having it once is enough.
I have the following .htaccess file
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI}/ [L,R=301]
</IfModule>
# END WordPress
This is the link of the website.
Another domain hosted on the same server needs to be redirected to the login.php page and I am not the developer nor I have the knowledge of how that redirection is made. Yet I have to stop being redirected to the login.php. Is there a way to achieve this by .htaccess?
I actually want to enable https only on the home page and the signup page, which I can do with a HTTPS plugin. When I enable them, as I stated they go to the login.php file...
Important note: the link/domain above doesn't have an ssl configured but the other domain which needs to be redirected has it. But they have a CA bundle installed on the server.
Second important note: I actually need this to pass the data with https to securely use the fb - twitter - linkedin login buttons.
I'd be very glad for any advice. Thanks for your time!
Edit #1 - the other domain mentioned above has only these on the .htaccess
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
You need your redirect rule to come Before your wordpress routing rules. Otherwise the route happens first, rewriting whatever URL you requested, then the second rule redirects the internal route.
Try:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI}/ [L,R=301]
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
Im using the following .htaccess for my website. I redirect all urls to index.php if their isn't a file located at the url.
Options +FollowSymLinks
IndexIgnore */*
# Turn on the RewriteEngine
RewriteEngine On
# Rules
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php
This way http://website.com/user/user_name/ goes to index.php
and
http://website.com/css/style.css gives the actual css file (if style.css exists).
This works great, only i want to force https:// on the urls and i can't manage to get it to work. Any help is greatly appreciated.
Edit:
Using Jeroen's answer I got it working with the following .htaccess
Options +FollowSymLinks
IndexIgnore */*
# Turn on the RewriteEngine
RewriteEngine On
# Rules
RewriteCond %{HTTP:CF-Visitor} '"scheme":"http"'
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L,QSA]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php
As you are using CloudFlare's ssl - I assume Flexible SSL - you need a different solution although #Fox's solution is correct for a "normal" ssl connection.
For CloudFlare you need something like:
RewriteCond %{HTTP:CF-Visitor} '"scheme":"http"'
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L,QSA]
Also see CloudFlare's support article.
Try this
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>
I am trying to make SSL and Redirection work perfectly with my web application. I wish to achieve that always https://www.mydomain.com/ should be loaded in the browser - although, if he types a subdomain - it should be redirected to https://subdomain.mydomain.com/ instead.
I mean to say, everything should be SSL - here is what I am doing currently
Options -Indexes
Options +FollowSymLinks
DirectoryIndex index.php
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_HOST} !^(www) [NC]
RewriteRule ^(.*)$ http://www.mydomain.com/$1 [L,R=301]
RewriteCond %{REQUEST_FILENAME} !index.php
RewriteRule (.*)\.php$ index.php/$1
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [QSA,L]
</IfModule>
<IfModule !mod_rewrite.c>
ErrorDocument 404 index.php
</IfModule>
Also, I wish to improve this .htaccess file so to introduce more security measures plus also allow only js, css and images files to be accessible by everyone - rest everything hidden or redirected to a 404 page.
Please guide, I would be greatly thankful!
These rewrite conditions may help you, I use this to make my CodeIgniter go to HTTPS:
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]