Related
I have configured server with lucee tomcat and apache2 for virtual host on ubuntu. I have enabled rewrite rule and my virtual host is as followes.
<VirtualHost *:80>
ServerAdmin admin#example.com
ServerName example.com
ServerAlias example.com www.example.com
DocumentRoot /var/www/html/example.com/
<Directory /var/www/html/example.com/>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error_main_example.log
CustomLog ${APACHE_LOG_DIR}/access_main_example.log combined
DirectoryIndex index.cfm
</VirtualHost>
redirect from htaccess file is working good but rewrite rule is not working. Here is the htaccess file that i am trying.
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [L,R=301]
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
RewriteRule ^(.*)/abc/([0-9]+)$ /test-404.cfm [L]
Here are the example URLs:
https://www.example.com/example.cfm/abc/2
https://www.example.com/example.cfm/abc/8
https://www.example.com/example.cfm/abc/15
It is showing me tomcat 404 error that
HTTP Status 404 – Not Found
Type Status Report
Message The requested resource [/example.cfm/abc/2] is not available
Description The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.
Apache Tomcat/9.0.35
Can any body help me about this issue. By the way, site is configured using classic load balancer on AWS.
I'm posting a working solution here also, because you didn't answer to our posts of this cross post at the Lucee forum. This solution might also help others with the same problem.
The issue is that mod_proxy will always preced urlrewrite, unless you invoke mod_proxy with a special urlrewrite rule. To make urlrewrite work and use mod_proxy, you need to flag the rewrite rule with [P] (for proxy). Here is a working example that should work for you:
Step: Set everything in apache2.conf in mod_proxy.c as comment, just leaving ProxyPreserveHost and ProxyPassReverse, like so:
<IfModule mod_proxy.c>
ProxyPreserveHost On
#ProxyPassMatch ^/(.+\.cf[cm])(/.*)?$ http://127.0.0.1:8888/$1$2
#ProxyPassMatch ^/(.+\.cfml)(/.*)?$ http://127.0.0.1:8888/$1$2
# optional mappings
#ProxyPassMatch ^/flex2gateway/(.*)$ http://127.0.0.1:8888/flex2gateway/$1
#ProxyPassMatch ^/messagebroker/(.*)$ http://127.0.0.1:8888/messagebroker/$1
#ProxyPassMatch ^/flashservices/gateway(.*)$ http://127.0.0.1:8888/flashservices/gateway$1
#ProxyPassMatch ^/openamf/gateway/(.*)$ http://127.0.0.1:8888/openamf/gateway/$1
#ProxyPassMatch ^/rest/(.*)$ http://127.0.0.1:8888/rest/$1
ProxyPassReverse / http://127.0.0.1:8888/
</IfModule>
Step: In your virtual host configuration set the following rewrite rules ( that may work also in your .htaccess, but I’m not sure).
...
<Directory /var/www/html/example.com/>
...
...
RewriteEngine On
RewriteBase /
# Catch non-existing files/directories and pass them via proxy to a 404 cfml errorpage
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule "^(.*)$" "http://127.0.0.1:8888/my-404.cfm" [P]
# Catch https://www.example.com/example.cfm/abc/2
# Catch https://www.example.com/example.cfm/abc/7 etc.
RewriteRule "^example.cfm(/abc/[0-9]+)$" "http://127.0.0.1:8888/my-404.cfm" [P]
# Pass request for cfm/cfc files to proxy with mod_rewrite rule
RewriteRule "^(.+\.cf[cm])(/.*)?$" "http://127.0.0.1:8888/$1$2" [P]
...
</Directory>
I’ve tested it and the solution above works fine.
I'm trying to redirect all insecure HTTP requests on my site (e.g. http://www.example.com) to HTTPS (https://www.example.com). How can I do this in .htaccess file?
By the way, I'm using PHP.
The Apache docs recommend against using a rewrite:
To redirect http URLs to https, do the following:
<VirtualHost *:80>
ServerName www.example.com
Redirect / https://www.example.com/
</VirtualHost>
<VirtualHost *:443>
ServerName www.example.com
# ... SSL configuration goes here
</VirtualHost>
This snippet should go into main server configuration file, not into .htaccess as asked in the question.
This article might have come up only after the question was asked and answered, but seems to be the current way to go.
Update: Although this answer has been accepted a few years ago, note that its approach is now recommended against by the Apache documentation. Use a Redirect instead. See this answer.
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
I'd recommend with 301 redirect:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
As I was saying in this question, I'd suggest you avoid redirecting all HTTP requests to their HTTPS equivalent blindly, as it may cause you a false impression of security. Instead, you should probably redirect the "root" of your HTTP site to the root of your HTTPS site and link from there, only to HTTPS.
The problem is that if some link or form on the HTTPS site makes the client send a request to the HTTP site, its content will be visible, before the redirection.
For example, if one of your pages served over HTTPS has a form that says <form action="http://example.com/doSomething"> and sends some data that shouldn't be sent in clear, the browser will first send the full request (including entity, if it's a POST) to the HTTP site first. The redirection will be sent immediately to the browser and, since a large number of users disable or ignore the warnings, it's likely to be ignored.
Of course, the mistake of providing the links that should be to the HTTPS site but that end up being for the HTTP site may cause problems as soon as you get something listening on the HTTP port on the same IP address as your HTTPS site. However, I think keeping the two sites as a "mirror" only increases the chances of making mistakes, as you may tend to make the assumption that it will auto-correct itself by redirecting the user to HTTPS, whereas it's often too late. (There were similar discussions in this question.)
This is the html redirect approach it works but not the best.
<meta http-equiv="Refresh" content="0;URL=https://www.example.com" />
PHP approach
<?php
function redirectTohttps() {
if ($_SERVER['HTTPS']!="on") {
$redirect= "https://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
header("Location:$redirect");
}
}
?>
.htaccess approch
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
copied from:
www.letuslook.org
I found out that the best way for https and www on domain is
RewriteCond %{HTTPS} off
RewriteCond %{HTTPS_HOST} !^www.example.com$ [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [L,R=301]
I like this method of redirecting from http to https. Because I don't need to edit it for each site.
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
Using the following code in your .htaccess file automatically redirects visitors to the HTTPS version of your site:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
If you have an existing .htaccess file:
Do not duplicate RewriteEngine On.
Make sure the lines beginning RewriteCond and RewriteRule immediately follow the already-existing RewriteEngine On.
The best solution depends on your requirements. This is a summary of previously posted answers with some context added.
If you work with the Apache web server and can change its configuration, follow the Apache documentation:
<VirtualHost *:80>
ServerName www.example.com
Redirect "/" "https://www.example.com/"
</VirtualHost>
<VirtualHost *:443>
ServerName www.example.com
# ... SSL configuration goes here
</VirtualHost>
But you also asked if you can do it in a .htaccess file. In that case you can use Apache's RewriteEngine:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]
If everything is working fine and you want browsers to remember this redirect, you can declare it as permanent by changing the last line to:
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
But be careful if you may change your mind on this redirect. Browsers remember it for a very long time and won't check if it changed.
You may not need the first line RewriteEngine On depending on the webserver configuration.
If you look for a PHP solution, look at the $_SERVER array and the header function:
if (!$_SERVER['HTTPS']) {
header("Location: https://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
}
This is the proper method of redirecting HTTP to HTTPS using .htaccess according to GoDaddy.com. The first line of code is self-explanatory. The second line of code checks to see if HTTPS is off, and if so it redirects HTTP to HTTPS by running the third line of code, otherwise the third line of code is ignored.
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
https://www.godaddy.com/help/redirect-http-to-https-automatically-8828
Add the following code to the .htaccess file:
Options +SymLinksIfOwnerMatch
RewriteEngine On
RewriteCond %{SERVER_PORT} !=443
RewriteRule ^ https://[your domain name]%{REQUEST_URI} [R,L]
Where [your domain name] is your website's domain name.
You can also redirect specific folders off of your domain name by replacing the last line of the code above with:
RewriteRule ^ https://[your domain name]/[directory name]%{REQUEST_URI} [R,L]
Do everything that is explained above for redirection. Just add "HTTP Strict Transport Security" to your header. This will avoid man in the middle attack.
Edit your apache configuration file (/etc/apache2/sites-enabled/website.conf and /etc/apache2/httpd.conf for example) and add the following to your VirtualHost:
# Optionally load the headers module:
LoadModule headers_module modules/mod_headers.so
<VirtualHost 67.89.123.45:443>
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
</VirtualHost>
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
To redirect all http requests to https , you can use :
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R]
If mod-rewrite isn't enabled and you are on apache 2.4, you can also use a Redirect inside if directive to redirect http requests to https .
Apache 2.4.
<if "%{HTTPS} !~ /on/">
Redirect / https://www.example.com/
</if>
If you are in a situation where your cannot access the apache config directly for your site, which many hosted platforms are still restricted in this fashion, then I would actually recommend a two-step approach. The reason why Apache themselves document that you should use their configuration options first and foremost over the mod_rewrite for HTTP to HTTPS.
First, as mentioned above, you would setup your .htaccess mod_rewrite rule(s):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Then, in your PHP file(s) (you need to do this where ever it would be appropriate for your situation, some sites will funnel all requests through a single PHP file, others serve various pages depending on their needs and the request being made):
<?php if ($_SERVER['HTTPS'] != 'on') { exit(1); } ?>
The above needs to run BEFORE any code that could potentially expose secure data in an unsecured environment. Thus your site uses automatic redirection via HTACCESS and mod_rewrite, while your script(s) ensure no output is provided when not accessed through HTTPS.
I guess most people don't think like this, and thus Apache recommends that you don't use this method where possible. However, it just takes an extra check on the development end to ensure your user's data is secure. Hopefully this helps someone else who might have to look into using non-recommended methods due to restrictions on our hosting services end.
Unless you need mod_rewrite for other things, using Apache core IF directive is cleaner & faster:
<If "%{HTTPS} == 'off'">
Redirect permanent / https://yoursite.com/
</If>
You can add more conditions to the IF directive, such as ensure a single canonical domain without the www prefix:
<If "req('Host') != 'myonetruesite.com' || %{HTTPS} == 'off'">
Redirect permanent / https://myonetruesite.com/
</If>
There's a lot of familiarity inertia in using mod_rewrite for everything, but see if this works for you.
More info: https://httpd.apache.org/docs/2.4/mod/core.html#if
To see it in action (try without www. or https://, or with .net instead of .com): https://nohodental.com/ (a site I'm working on).
Redirect 301 / https://example.com/
(worked for me when none of the above answers worked)
Bonus:
ServerAlias www.example.com example.com
(fixed https://www.example.com not found)
take this code to you .htaccess file
Redirect HTTP to HTTPS automatically
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
The above things are for the Apache server only. What if running PHP at tomcat?
So you can use PHP code, whether it is Apache/tomcat/Nginx etc...
if (!((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) &&
$_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https'))){
$redirect = 'https://' . str_replace($_SERVER['SERVER_PORT'], 8443, $_SERVER['HTTP_HOST']) . $_SERVER['REQUEST_URI'];
header('HTTP/1.1 301 Moved Permanently');
header('Location: ' . $redirect);
exit();
}
After lots of tries by considering without www and with www this works this
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} (www\.)?yourdomain.com
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Through .htaccess This will help.
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
Also, Refer this for More Detail. How To Redirect Http To Https?
I found a method to force all pages of my site redirect from http to analog of pages on https that work for me.
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
This redirects all the URLs to https and www
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTPS_HOST} !^www.example.com$ [NC,OR]
RewriteCond %{HTTP_HOST} !^www.example.com$ [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [L,R=301]
If you want to do it from the tomcat server follow the below steps
In a standalone Apache Tomcat (8.5.x) HTTP Server, how can configure it so if a user types www.domain.com, they will be automatically forwarded to https(www.domain.com) site.
The 2 step method of including the following in your [Tomcat_base]/conf/web.xml before the closing tag
step 1:
<security-constraint>
<web-resource-collection>
<web-resource-name>HTTPSOnly</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
and setting the [Tomcat_base]/conf/server.xml connector settings:
step 2:
<Connector URIEncoding="utf-8" connectionTimeout="20000" port="80" protocol="HTTP/1.1" redirectPort="443"/>
<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateKeystoreFile="[keystorelocation]" type="RSA" />
</SSLHostConfig>
</Connector>
Note: If you already did the https configuration and trying to redirect do step 1 only.
Not only can you do this in your .htaccess file, you should be doing this period. You will also want to follow the steps here to get your site listed on the HSTS preload list after you implement this redirect so that any requests to the insecure http version of your website never make it past the user agent. Instead, the user agent checks the requested URI against a baked in list of https only websites and, if the requested URI is on that list, changes the protocol from http to https before transmitting the request to the server. Therefore, the insecure request never makes it out into the wild and never hits the server. Eventually when the internet changes over to https only the HSTS preload list will not be needed. Until then, every site should be using it.
In order to perform the redirect, we need to enable the rewrite engine and then redirect all traffic from the http port 80 to https.
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://yourwebsite.tld/$1 [L,R=301]
I tried all .htaccess configurations I could find on the internet but none worked.
Then, I realized Apache discourages using mod_rewrite.
My solution was to edit apache configuration files under the following folder:
/etc/apache2/sites-enabled
You will have one mandatory file named 000-default.conf and an ssl configuration file named 000-default-le-ssl.conf (if you have installed ssl certificate from letsencrypt/certbot). However, these files can be named differently depending on the file names you provided when setting up the site.
In 000-default.conf, I edited the following inside <VirtualHost *:80> as:
<VirtualHost *:80>
ServerName example.com
Redirect / https://example.com/
</VirtualHost>
In 000-default-le-ssl.conf, I edited the following inside <VirtualHost *:80> as:
<VirtualHost *:80>
ServerName example.com
Redirect / https://example.com/
</VirtualHost>
No other redirection is needed.
Save the file then restart the apache server using sudo service apache2 restart
I was actually trying to get this to work on an EC2 instance without a load balancer since that costs money. I've read everywhere that .htaccess isn't the "right" way to do it. Obviously, it will work, but I was trying to keep things by the book. I was following all of the examples to update the httpd.conf file and adding a lot of unnecessary stuff. It turns out the only line you really need is this:
Redirect permanent / https://www.yourdomain.com
My problem was that originally I had added this in a VirtualHost tag inside of httpd.conf, which is what a lot of posts tell you to do, but it wasn't working. It turns out there was a separate conf file stored in /etc/httpd/conf.d called yourdomain.conf which already had the VirtualHost tag and was overriding my httpd.conf settings. I just added the above line inside of it and voila, it instantly redirected to https. There is no need for the separate VirtualHost for port 443.
It's working now and the VirtualHost tag looks like this:
<VirtualHost *:80>
ServerName yourdomain.com
DocumentRoot /var/www/html
ServerAlias www.yourdomain.com
ErrorLog /var/www/error.log
CustomLog /var/www/requests.log combined
Redirect permanent / https://www.yourdomain.com
</VirtualHost>
Note: I already had TLS setup with a FREE certificate from certbot (Love those guys) and was just trying to redirect regular http calls to the working https site.
If you are using Apache, mod_rewrite is the easiest solution, and has a lot of documentation online how to do that. For example: http://www.askapache.com/htaccess/http-https-rewriterule-redirect.html
A different edge to this problem is when a Load Balancer comes into play.
The situation is as follows:
- Traffic from browser to Load Balancer, and back, is (should be) HTTPS
- Traffic between Load Balancer and actual WebServer is HTTP.
So, all server request variables in PHP or Apache show that the connection is just HTTP. And the HTTP and HTTPS directories on the Server are the same.
The RewriteCondition in the approved answer does not work.
It gives either a loop or it just doesn't work.
Question is: How to get this working on a Load Balancer.
(Or is the Load Balancer configured wrong. Which is what I'm hoping for because then I can move the problem over to the WebHosting company :-) )
If you're using an Amazon Web Services Elastic Load Balancer which accepts https traffic and routes it to your server(s) with http, the correct way to redirect all http traffic to https is described here: https://aws.amazon.com/premiumsupport/knowledge-center/redirect-http-https-elb
Use the X-Forwarded-Proto header (contains http or https) which is always included in http requests from the load balancer, as described here: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/x-forwarded-headers.html
In the httpd.conf file:
<VirtualHost *:80>
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule .* https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]
</VirtualHost>
Or in your root .htaccess file:
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule .* https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]
Bonus: it will not try to redirect http traffic on your local development machine.
It works for me:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
and for example, http://server/foo?email=someone%40example.com redirects normally without any issues.
The file .htaccess located in the website root folder (for example named public_html).
It is possible to use
RewriteCond %{SERVER_PORT} !^443$ instead RewriteCond %{HTTPS} !on
I have a Drupal 7 website, some resources are being requests with the Host set to have the www prefix while others are not.
https://www.example.com when request header is 301 Moved Permanently
https://example.com when request header is 304 Not Modified
Changing the base_url does not appear to modify the behaviour.
Is there anyway I can make drupal set the Host as https://example.com for all the request headers?
There's an Apache wiki page, which shows a solution to your requirement. The first solution uses a virtual host setup and the Redirect directive
# Redirect every request to example.com
<VirtualHost *:80>
ServerName www.example.net
ServerAlias www.example.com
Redirect permanent / http://example.com/
</VirtualHost>
# Define virtual host for example.com
<VirtualHost *:80>
ServerName example.com
DocumentRoot /usr/local/apache/htdocs
</VirtualHost>
And the second setup uses a mod_rewrite redirect
RewriteCond %{HTTP_HOST} !^example\.com [NC]
RewriteCond %{HTTP_HOST} !=""
RewriteRule ^ http://example.com%{REQUEST_URI} [L,R]
You can choose whichever fits your environment best.
I have an ecommerce site, and I want to enable https only on the ecommerce section of the site located at https://mysite.com/buy
Since all of the links on my pages are relative, when someone visits http://mysite.com and clicks on Buy, they are taken to http://mysite.com/buy
Also, if they visit https://mysite.com/buy and click on a link to another page, they are taken to https://mysite.com.
The reason I want https only on that one section is because I have external elements (i.e. Google Maps, Youtube, Twitter, etc) that cannot be sent over https.
Is there a way with htaccess that I can make the /buy directory force https, but every other page force http?
Edit:
In case anyone is interested, I was able to solve this using PHP. I would still prefer an htaccess solution, but this will work for now:
if($_SERVER['HTTPS'] == "on") {
if(strpos($_SERVER['REQUEST_URI'],"buy") === false) {
Header("Location: http://$_SERVER['HTTP_HOST']."".$_SERVER['REQUEST_URI']");
}
}
Try this in your .htaccess file:
Options +FollowSymLinks
RewriteEngine on
# redirect for http /buy page
RewriteCond %{SERVER_PORT} =80
RewriteRule ^buy/?$ https://mysite.com/buy [R=301,QSA,L,NE]
# redirect for https non /buy pages
RewriteCond %{SERVER_PORT} =443
RewriteCond %{REQUEST_URI} !^/buy [NC]
RewriteRule ^/?(.*)$ http://mysite.com/$1 [R=301,QSA,L,NE]
R=301 will redirect with https status 301
L will make last rule
NE is for no escaping query string
QSA will append your existing query parameters
NC is for ignore case comparison
$1 is your REQUEST_URI
I don't have hands on experience, but from what I see, it looks like the htaccess configuration file should impact only the files in the folder in which the file is stored.
So you should be able to do something like this:
http://www.besthostratings.com/articles/force-ssl-htaccess.html
And put it in the /buy folder of your site.
If your web page is hosted on 9001 port just enable any port on your linux box and make these changes in /etc/httpd/conf.d/ssl.conf.Then set your Listen Port to 9002 and create SSL certificate and key and put following configuration in your httpd.conf file
Listen 9001
<VirtualHost *:9001>
ServerAdmin root#localhost
DocumentRoot /mnt/work/httpd
<Directory "/mnt/work/httpd">
Options FollowSymLinks
AllowOverride AuthConfig
</Directory>
SSLEngine On
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
SSLCertificateKeyFile /etc/httpd/www.test.example.com.key
SSLCertificateFile /etc/httpd/www.test.example.com.crt
RewriteCond %{HTTPS} off
RewriteRule (.*) https://www.test.example.com:9002%{REQUEST_URI}
and your .htaccess file should look like this
AuthType Digest
AuthName "Protected"
AuthDigestProvider file
AuthGroupFile /dev/null
AuthUserFile /mnt/work/httpd/digest_auth
Require user username**
I'm trying to redirect all insecure HTTP requests on my site (e.g. http://www.example.com) to HTTPS (https://www.example.com). How can I do this in .htaccess file?
By the way, I'm using PHP.
The Apache docs recommend against using a rewrite:
To redirect http URLs to https, do the following:
<VirtualHost *:80>
ServerName www.example.com
Redirect / https://www.example.com/
</VirtualHost>
<VirtualHost *:443>
ServerName www.example.com
# ... SSL configuration goes here
</VirtualHost>
This snippet should go into main server configuration file, not into .htaccess as asked in the question.
This article might have come up only after the question was asked and answered, but seems to be the current way to go.
Update: Although this answer has been accepted a few years ago, note that its approach is now recommended against by the Apache documentation. Use a Redirect instead. See this answer.
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
I'd recommend with 301 redirect:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
As I was saying in this question, I'd suggest you avoid redirecting all HTTP requests to their HTTPS equivalent blindly, as it may cause you a false impression of security. Instead, you should probably redirect the "root" of your HTTP site to the root of your HTTPS site and link from there, only to HTTPS.
The problem is that if some link or form on the HTTPS site makes the client send a request to the HTTP site, its content will be visible, before the redirection.
For example, if one of your pages served over HTTPS has a form that says <form action="http://example.com/doSomething"> and sends some data that shouldn't be sent in clear, the browser will first send the full request (including entity, if it's a POST) to the HTTP site first. The redirection will be sent immediately to the browser and, since a large number of users disable or ignore the warnings, it's likely to be ignored.
Of course, the mistake of providing the links that should be to the HTTPS site but that end up being for the HTTP site may cause problems as soon as you get something listening on the HTTP port on the same IP address as your HTTPS site. However, I think keeping the two sites as a "mirror" only increases the chances of making mistakes, as you may tend to make the assumption that it will auto-correct itself by redirecting the user to HTTPS, whereas it's often too late. (There were similar discussions in this question.)
This is the html redirect approach it works but not the best.
<meta http-equiv="Refresh" content="0;URL=https://www.example.com" />
PHP approach
<?php
function redirectTohttps() {
if ($_SERVER['HTTPS']!="on") {
$redirect= "https://".$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI'];
header("Location:$redirect");
}
}
?>
.htaccess approch
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
copied from:
www.letuslook.org
I found out that the best way for https and www on domain is
RewriteCond %{HTTPS} off
RewriteCond %{HTTPS_HOST} !^www.example.com$ [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [L,R=301]
I like this method of redirecting from http to https. Because I don't need to edit it for each site.
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
Using the following code in your .htaccess file automatically redirects visitors to the HTTPS version of your site:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
If you have an existing .htaccess file:
Do not duplicate RewriteEngine On.
Make sure the lines beginning RewriteCond and RewriteRule immediately follow the already-existing RewriteEngine On.
The best solution depends on your requirements. This is a summary of previously posted answers with some context added.
If you work with the Apache web server and can change its configuration, follow the Apache documentation:
<VirtualHost *:80>
ServerName www.example.com
Redirect "/" "https://www.example.com/"
</VirtualHost>
<VirtualHost *:443>
ServerName www.example.com
# ... SSL configuration goes here
</VirtualHost>
But you also asked if you can do it in a .htaccess file. In that case you can use Apache's RewriteEngine:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]
If everything is working fine and you want browsers to remember this redirect, you can declare it as permanent by changing the last line to:
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
But be careful if you may change your mind on this redirect. Browsers remember it for a very long time and won't check if it changed.
You may not need the first line RewriteEngine On depending on the webserver configuration.
If you look for a PHP solution, look at the $_SERVER array and the header function:
if (!$_SERVER['HTTPS']) {
header("Location: https://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
}
This is the proper method of redirecting HTTP to HTTPS using .htaccess according to GoDaddy.com. The first line of code is self-explanatory. The second line of code checks to see if HTTPS is off, and if so it redirects HTTP to HTTPS by running the third line of code, otherwise the third line of code is ignored.
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
https://www.godaddy.com/help/redirect-http-to-https-automatically-8828
Add the following code to the .htaccess file:
Options +SymLinksIfOwnerMatch
RewriteEngine On
RewriteCond %{SERVER_PORT} !=443
RewriteRule ^ https://[your domain name]%{REQUEST_URI} [R,L]
Where [your domain name] is your website's domain name.
You can also redirect specific folders off of your domain name by replacing the last line of the code above with:
RewriteRule ^ https://[your domain name]/[directory name]%{REQUEST_URI} [R,L]
Do everything that is explained above for redirection. Just add "HTTP Strict Transport Security" to your header. This will avoid man in the middle attack.
Edit your apache configuration file (/etc/apache2/sites-enabled/website.conf and /etc/apache2/httpd.conf for example) and add the following to your VirtualHost:
# Optionally load the headers module:
LoadModule headers_module modules/mod_headers.so
<VirtualHost 67.89.123.45:443>
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
</VirtualHost>
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
To redirect all http requests to https , you can use :
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,L,R]
If mod-rewrite isn't enabled and you are on apache 2.4, you can also use a Redirect inside if directive to redirect http requests to https .
Apache 2.4.
<if "%{HTTPS} !~ /on/">
Redirect / https://www.example.com/
</if>
If you are in a situation where your cannot access the apache config directly for your site, which many hosted platforms are still restricted in this fashion, then I would actually recommend a two-step approach. The reason why Apache themselves document that you should use their configuration options first and foremost over the mod_rewrite for HTTP to HTTPS.
First, as mentioned above, you would setup your .htaccess mod_rewrite rule(s):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
Then, in your PHP file(s) (you need to do this where ever it would be appropriate for your situation, some sites will funnel all requests through a single PHP file, others serve various pages depending on their needs and the request being made):
<?php if ($_SERVER['HTTPS'] != 'on') { exit(1); } ?>
The above needs to run BEFORE any code that could potentially expose secure data in an unsecured environment. Thus your site uses automatic redirection via HTACCESS and mod_rewrite, while your script(s) ensure no output is provided when not accessed through HTTPS.
I guess most people don't think like this, and thus Apache recommends that you don't use this method where possible. However, it just takes an extra check on the development end to ensure your user's data is secure. Hopefully this helps someone else who might have to look into using non-recommended methods due to restrictions on our hosting services end.
Unless you need mod_rewrite for other things, using Apache core IF directive is cleaner & faster:
<If "%{HTTPS} == 'off'">
Redirect permanent / https://yoursite.com/
</If>
You can add more conditions to the IF directive, such as ensure a single canonical domain without the www prefix:
<If "req('Host') != 'myonetruesite.com' || %{HTTPS} == 'off'">
Redirect permanent / https://myonetruesite.com/
</If>
There's a lot of familiarity inertia in using mod_rewrite for everything, but see if this works for you.
More info: https://httpd.apache.org/docs/2.4/mod/core.html#if
To see it in action (try without www. or https://, or with .net instead of .com): https://nohodental.com/ (a site I'm working on).
Redirect 301 / https://example.com/
(worked for me when none of the above answers worked)
Bonus:
ServerAlias www.example.com example.com
(fixed https://www.example.com not found)
take this code to you .htaccess file
Redirect HTTP to HTTPS automatically
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
The above things are for the Apache server only. What if running PHP at tomcat?
So you can use PHP code, whether it is Apache/tomcat/Nginx etc...
if (!((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) &&
$_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https'))){
$redirect = 'https://' . str_replace($_SERVER['SERVER_PORT'], 8443, $_SERVER['HTTP_HOST']) . $_SERVER['REQUEST_URI'];
header('HTTP/1.1 301 Moved Permanently');
header('Location: ' . $redirect);
exit();
}
After lots of tries by considering without www and with www this works this
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} (www\.)?yourdomain.com
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Through .htaccess This will help.
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [R=301,L]
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
Also, Refer this for More Detail. How To Redirect Http To Https?
I found a method to force all pages of my site redirect from http to analog of pages on https that work for me.
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
This redirects all the URLs to https and www
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTPS_HOST} !^www.example.com$ [NC,OR]
RewriteCond %{HTTP_HOST} !^www.example.com$ [NC]
RewriteRule ^(.*)$ https://www.example.com/$1 [L,R=301]
If you want to do it from the tomcat server follow the below steps
In a standalone Apache Tomcat (8.5.x) HTTP Server, how can configure it so if a user types www.domain.com, they will be automatically forwarded to https(www.domain.com) site.
The 2 step method of including the following in your [Tomcat_base]/conf/web.xml before the closing tag
step 1:
<security-constraint>
<web-resource-collection>
<web-resource-name>HTTPSOnly</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
and setting the [Tomcat_base]/conf/server.xml connector settings:
step 2:
<Connector URIEncoding="utf-8" connectionTimeout="20000" port="80" protocol="HTTP/1.1" redirectPort="443"/>
<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateKeystoreFile="[keystorelocation]" type="RSA" />
</SSLHostConfig>
</Connector>
Note: If you already did the https configuration and trying to redirect do step 1 only.
Not only can you do this in your .htaccess file, you should be doing this period. You will also want to follow the steps here to get your site listed on the HSTS preload list after you implement this redirect so that any requests to the insecure http version of your website never make it past the user agent. Instead, the user agent checks the requested URI against a baked in list of https only websites and, if the requested URI is on that list, changes the protocol from http to https before transmitting the request to the server. Therefore, the insecure request never makes it out into the wild and never hits the server. Eventually when the internet changes over to https only the HSTS preload list will not be needed. Until then, every site should be using it.
In order to perform the redirect, we need to enable the rewrite engine and then redirect all traffic from the http port 80 to https.
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://yourwebsite.tld/$1 [L,R=301]
I tried all .htaccess configurations I could find on the internet but none worked.
Then, I realized Apache discourages using mod_rewrite.
My solution was to edit apache configuration files under the following folder:
/etc/apache2/sites-enabled
You will have one mandatory file named 000-default.conf and an ssl configuration file named 000-default-le-ssl.conf (if you have installed ssl certificate from letsencrypt/certbot). However, these files can be named differently depending on the file names you provided when setting up the site.
In 000-default.conf, I edited the following inside <VirtualHost *:80> as:
<VirtualHost *:80>
ServerName example.com
Redirect / https://example.com/
</VirtualHost>
In 000-default-le-ssl.conf, I edited the following inside <VirtualHost *:80> as:
<VirtualHost *:80>
ServerName example.com
Redirect / https://example.com/
</VirtualHost>
No other redirection is needed.
Save the file then restart the apache server using sudo service apache2 restart
I was actually trying to get this to work on an EC2 instance without a load balancer since that costs money. I've read everywhere that .htaccess isn't the "right" way to do it. Obviously, it will work, but I was trying to keep things by the book. I was following all of the examples to update the httpd.conf file and adding a lot of unnecessary stuff. It turns out the only line you really need is this:
Redirect permanent / https://www.yourdomain.com
My problem was that originally I had added this in a VirtualHost tag inside of httpd.conf, which is what a lot of posts tell you to do, but it wasn't working. It turns out there was a separate conf file stored in /etc/httpd/conf.d called yourdomain.conf which already had the VirtualHost tag and was overriding my httpd.conf settings. I just added the above line inside of it and voila, it instantly redirected to https. There is no need for the separate VirtualHost for port 443.
It's working now and the VirtualHost tag looks like this:
<VirtualHost *:80>
ServerName yourdomain.com
DocumentRoot /var/www/html
ServerAlias www.yourdomain.com
ErrorLog /var/www/error.log
CustomLog /var/www/requests.log combined
Redirect permanent / https://www.yourdomain.com
</VirtualHost>
Note: I already had TLS setup with a FREE certificate from certbot (Love those guys) and was just trying to redirect regular http calls to the working https site.
If you are using Apache, mod_rewrite is the easiest solution, and has a lot of documentation online how to do that. For example: http://www.askapache.com/htaccess/http-https-rewriterule-redirect.html
A different edge to this problem is when a Load Balancer comes into play.
The situation is as follows:
- Traffic from browser to Load Balancer, and back, is (should be) HTTPS
- Traffic between Load Balancer and actual WebServer is HTTP.
So, all server request variables in PHP or Apache show that the connection is just HTTP. And the HTTP and HTTPS directories on the Server are the same.
The RewriteCondition in the approved answer does not work.
It gives either a loop or it just doesn't work.
Question is: How to get this working on a Load Balancer.
(Or is the Load Balancer configured wrong. Which is what I'm hoping for because then I can move the problem over to the WebHosting company :-) )
If you're using an Amazon Web Services Elastic Load Balancer which accepts https traffic and routes it to your server(s) with http, the correct way to redirect all http traffic to https is described here: https://aws.amazon.com/premiumsupport/knowledge-center/redirect-http-https-elb
Use the X-Forwarded-Proto header (contains http or https) which is always included in http requests from the load balancer, as described here: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/x-forwarded-headers.html
In the httpd.conf file:
<VirtualHost *:80>
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule .* https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]
</VirtualHost>
Or in your root .htaccess file:
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http
RewriteRule .* https://%{HTTP:Host}%{REQUEST_URI} [L,R=permanent]
Bonus: it will not try to redirect http traffic on your local development machine.
It works for me:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>
and for example, http://server/foo?email=someone%40example.com redirects normally without any issues.
The file .htaccess located in the website root folder (for example named public_html).
It is possible to use
RewriteCond %{SERVER_PORT} !^443$ instead RewriteCond %{HTTPS} !on