how can i access custom headers from an htaccess file? - apache

I am currently using HA proxy in front of an apache setup. Since HA proxy is doing the https termination, i can't use apache to tell if it's https or http.
So I got HA proxy to add a custom header to send to apache (X-Forwarded-Proto = http or https)
In my htaccess i would like to do a redirect based on that header, but it looks like i can only access the headers apache has specifically listed.
for example i can't do:
RewriteCond %{HTTP_X_FORWARDED_PROTO} !^https$
RewriteRule ^(.*) https://%{HTTP_HOST}$1
is there another way i can test the header?

You can use this rule:
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [NE,R=301,L]

Related

Difference between 2 apache mod_rewrites

I've found 2 different code snippets to force https on my website:
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]
and
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
I'm sure that they both work (one's from Httpd Wiki and the other's from SSL shopper). Would someone be able to explain the differences in how they perform the redirect?
They just use different Apache variables to make up the URL for redirect.
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]
This first rule takes the filename if one is entered such as myfile.php and appends the redirect with it replacing $1 in the redirect so that you get https://somesite.com/myfile.php
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
The 2nd one using %{HTTP_HOST} will grab the information from the http headers instead to make up the URL used to redirect so entering the same url http://somesite.com/myfile.php will be redirected to https://somesite.com/myfile.php
It's just a matter of telling apache what to use for redirection. Either use the server internal name or use the one sent by the browser.
%{SERVER_NAME}
That is a server internal variable in apache and is defined in the server config.
%{HTTP_HOST}
This is the what is sent by the browser in the HTTP request headers. This is client side while the SERVER_NAME if from the server config.
%{REQUEST_URI}
REQUEST_URI is the path component of the requested URI, such as "/index.html". This is a special Apache variable.
There a many ways that have been done to redirect to https and both should work. Your choice.

http to https redirection based on subdomain name

We have 3 sub domains pointed to a apache webserver,all the subdomains are for different web applications, we have got ssl against the sub domains,ssl certificates were installed, but we are not able to redirect the http requests to https.. we have to write manually https://subdomain.domain-name.com to access our applications...
We are using zend server 6 . please help us to know so that all the http request can be redirected to https.
we have written this on our httpd.conf file
RewriteEngine On
RewriteCond %{HTTP_HOST} ^(.*?)\.domain-name.com$
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*?)$ https://%{HTTP_HOST} [nc]
we are really new to this.we will be highly grateful.
Create .htaccess file on http://subdomain.domain-name.com and put this code in that
RewriteEngine On
RewriteRule ^$ https://subdomain.domain-name.com [L,R=302]

Redirect Loop while redirecting all http requests to https using .htaccess

I have the following rules on my .htaccess file
# to redirect http to https
RewriteCond %{HTTPS} off
RewriteRule (.*) https://www.example.com/$1 [R=301,L]
# to redirect urls with index.php to /
RewriteCond %{THE_REQUEST} ^.*/index.php
RewriteRule ^(.*)index.php$ /$1 [R=301,L]
# to redirect non www requests to www url
RewriteCond %{HTTP_HOST} !^www\.example\.com
RewriteRule ^(.*)$ http://www.example.com/$1 [R=301,L]
When I am trying to access the website, it turns into a Redirect Loop. How to fix this issue and redirect properly?
Just in case somebody have redirect loop when using Apache http->https rewrite behind load balancer, here's solution that worked for me.
I had the same problem when used RewriteCond %{HTTPS} off for Apache behind load balancer, when load balancer does SSL stuff.
If https version of the site is not configured via Apache ModSSL it doesn't set %{HTTPS} variable to "on" and keeps redirecting infinitely.
The simplest solution to fix it is to target all https traffic to another Apache VirtualHost (when SSL is handled by load balancer) that is the copy of main one, but has different port (lets say 81). And in .htaccess do mod_rewrite for everything that is not on port 81:
ReWriteCond %{SERVER_PORT} !^81$
RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L]
The second way to do this is to send X-Forwarded-Proto header from load balancer to Apache and use it in rewrite condition:
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
I've seen a lot of people suffering redirect loops when trying to use .htaccess files to move from http to https. And there are a LOT of different answers to how to solve this issue. Some people say:
ReWriteCond %{SERVER_PORT} 80
OR
RewriteCond %{HTTPS} off
OR
RewriteCond %{HTTPS} !on
OR (as above)
RewriteCond %{HTTP:X-Forwarded-Proto} !https
OR EVEN
RewriteCond %{HTTP:X-Forwarded-SSL} =off
but none of these worked for me. I eventually discovered the underlying truth, that the different servers out there are configured in different ways, and they're all providing different server variables.
If none of the above work for you, then the trick is to use PHP to find out what env variables your particular server is sending you when you access an http page, and what env variables it sends you when you access an https page, and then you can use that variable to do the redirect. Just make a PHP file (such as showphpvars.php) on your server with this code:
<?php phpinfo() ?>
and then view it with a browser. Find the section of variables with _SERVER["HTTP_HOST" (etc)] in it, and have a scout around for one that changes for http versus https. Mine turned out to be a variable called SSL that was set to 1 when using https, and not set at all when using http.
I used that variable to redirect to https with PHP, which is so much nicer than using htaccess, but I think that any of the _SERVER variables can also be accessed using htaccess, if you're keen to continue to use that. Just use the name inside the quotes, without the _SERVER[""] bit that PHP adds.
For your information, it really depends on your hosting provider. It may be using a Load Balancer, as stated by Konstantin in another answer.
In my case (Infomaniak), nothing above actually worked and I got infinite redirect loop.
The right way to do this is actually explained in their support site:
RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule (.*) https://your-domain.com/$1 [R=301,L]
So, always check with your hosting provider. Hopefully they have an article explaining how to do this. Otherwise, just ask the support.
If you get a redirect loop no matter what you do in htaccess, do the redirect in PHP instead.
I used phpinfo(), like #z-m suggests, to find the variable that changes when I'm on SSL. In my case it was $_SERVER['HTTP_X_PROTO'] == "https". When not on SSL, this variable is not set.
This is the code I use to redirect from HTTP to HTTPS:
if ($_SERVER['HTTP_X_PROTO'] != "https") {
header("HTTP/1.1 301 Moved Permanently");
$location = "https://" . $_SERVER[HTTP_HOST] . $_SERVER[REQUEST_URI];
header("Location: $location");
exit;
}
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{
In my case it was:
if ($_SERVER['HTTPS'] != "on")

Force both HTTPS and HTTP with .htaccess

I have several domains under the same server, but my https certificated only works for one of them.
I need to force https for: mydomain1.com
All other domains (mydomain2.com, mydomain3.com ...) must use
http.
I know it must be a simple rule, but I wasn't able to figure it out.
I think you should edit your hosts file
if port is not SSL and domain is mydomain1.com, force redirect to https://
RewriteCond %{SERVER_PORT} !^443$
RewriteCond %{HTTP_HOST} mydomain1.com$
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L,QSA]

ISAPI Rewrite 3 rule for redirectling http to https for a particular site

I have multiple sites on a single IIS 6 server running ISAPI Rewrite 3 (free addition).
I need to redirect just one of the sites to https if the request comes in as http.
Example: I need http://bar.foo.com to redirect to https://bar.foo.com. I don't want this redirect to affect http://www.foo.com or http://foo.com or http://meh.foo.com.
What is the redirect syntax for this problem?
I found http://www.helicontech.com/isapi_rewrite/doc/examples.htm which shows how to redirect all requests to https.
The rules should look like:
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^bar\.foo\.com$ [NC]
RewriteRule .? https://bar.foo.com%{REQUEST_URI} [R=301,L]
That looks like an easy thing to do
RewriteEngine on
RewriteRule http://bar.foo.com https://bar.foo.com [NC]