apache rewrite: force https and name of server, not IP - apache

I want my apache to always force people to use https and to map IP based look ups to be forwarded to the server name. The following settings (in httpd.conf file) take care of the http to https redirect:
<Location />
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://my_server.example.com%{REQUEST_URI}
</Location>
But now I also want that if people type 192.168.1.2 they get redirected to my_server.example.com.
To sum up:
http://192.168.1.2/someurl -> https://my_server.example.com/someurl
I've tried several things but either my settings get ignored or I end up in a redirect loop.
any hints?

If you have access to the main config and not just .htaccess, this is something most easily done with separate virtual hosts rather than resorting to the Swiss Army chainsaw that is mod_rewrite.
<VirtualHost *:80>
Redirect permanent / https://my_server.example.com/
</VirtualHost>
<VirtualHost *:443>
Redirect permanent / https://my_server.example.com/
SSLEngine on
</VirtualHost>
<VirtualHost *:443>
ServerName my_server.example.com
SSLEngine on
...real site config...
</VirtualHost>
It's not just numeric IP address access you generally want to redirect to your canonical hostname, but all addresses other than the known-good domains you control. Putting a default virtual host first in the config, that redirects (or serves up nothing) helps avoid certain DNS-based XSS attacks.

I figured out the following solution:
<Location />
Options +FollowSymLinks
RewriteEngine On
RewriteCond %{HTTP_HOST} !^my_server\.example\.com [NC]
RewriteRule (.*) https://my_server.example.com%{REQUEST_URI} [R=301,L]
RewriteCond %{HTTPS} off
RewriteRule (.*) https://my_server.example.com%{REQUEST_URI}
</Location>
it does exactly what I need.

Related

How to skip HTTPS redirection, only if the url contains a substring?

In my Apache http.conf file, I have the following redirect setup, which means that if I access an endpoint using my server's domain name, it serves its HTTPS equivalent, instead of HTTP. However there's a particular URL where I do not want this address to occur. This is how i've got it set up at the moment:
<VirtualHost *:80>
ServerAdmin me#mydomain.com
DocumentRoot "/srv/httpd"
ServerName example.com
ServerAlias example.com
RewriteEngine On
RewriteCond %{SERVER_NAME} =example.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
So what do I need to add, so that if I were to access http://example.com/insecure/ (and anything within that folder), it doesn't redirect me anywhere, however it does redirect to HTTPS if i'm accessing anything else on my domain? Just a second RewriteCond? I'm not sure of the syntax
I've added a second RewriteCond of RewriteCond %{REQUEST_URI} !/insecure/ which seems to have done the job.

Apache2 - Resolving redirect to https

Even after trying several solutions, I'm trying to force HTTPS redirect on my website via the following configuration in the site's .htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
However, it's resulting in the error of too many redirects. I came to suspect this may be either because of the the HTTPS flag not being set or port number not switching to 443 on specifying https in the browser - as on outputting the port number via PHP, i.e, $_SERVER['SERVER_PORT'] it still shows 80. My .conf files were set up according to what I came across on what seemed to be reliable sources.
Any insights into how I can get this resolved would be appreciated.
Apache foundation suggests to avoid using mod_rewrite for this type of problem when possible.
You should use mod_alias Redirect directive instead.
<VirtualHost *:80>
ServerName www.example.com
Redirect "/" "https://www.example.com/"
</VirtualHost>
<VirtualHost *:443>
ServerName www.example.com
# ... SSL configuration goes here
</VirtualHost>
However, in cases where You are limited to .htaccess only and cannot alter vhost/main configuration files, You can do this:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule . https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

Apache Mod Rewrite all incoming urls to https://www

I want to redirect all incoming urls to my website to a single url for canonicalization purposes.
Following redirect conditions should meet
http://example.com-> https://www.example.com
http://www.example.com -> https://www.example.com
https://example.com -> https://www.example.com
www.example.com -> https://www.example.com
My current Rewrite rules written in httpd.conf look as follows
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L,NE]
With the above rules I am able to achieve 1st,2nd and 4th rule but 3rd doesn't work for me.
Any suggestions are welcome.
The definition for HTTPS and HTTP version of your site must (?) appear under different virtualhost entries (unless you are using some proxy in front of httpd).
This makes it easy to end up with differences between the configs in the two virtualhosts. Make sure the config for the redirect is the same in both virtualhosts for port 80 and port 443
The easiest way to do this is to make use of an Include statement and reference a common file in the two virtualhost definitions
For instance put these rewrites in a file base-rewrite.inc in the root config dorectory (/etc/apache2/base-rewrite.inc in debian/ubuntu; /etc/httpd/base-rewrite.inc in Redhat):
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [R=301,L,NE]
Then in your virtual hosts definition, Include this file:
<VirtualHost *:80>
# HTTP default virtualhost
ServerName www.example.com
DocumentRoot /var/www/html/
Include base-rewrite.inc
</VirtualHost>
<VirtualHost *:443>
# HTTPS default virtualhost
ServerName www.example.com
DocumentRoot /var/www/html/
# An example SSL config, but use your certificate files
SSLEngine on
SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
Include base-rewrite.inc
</VirtualHost>
This will keep the rewrites consistent and make it easy to maintain and change them all at once
If you're talking about canonicalization for SEO purposes then you should also add this meta tag to the head section of your web pages:
<link rel="canonical" href="https://www.example.com/" />
What this does is tell search engines that whatever url was used to reach this page, this is the preferred url and the one that should be indexed.

How can I use mod_rewrite to redirect to a https connection?

I am trying to always redirect people to
https://www.somedomain.com/URL
when they come in on a non secure port. This is because my SSL is for this url.
When someone goes to http://www.somedomain.com they get sent to
http://www.www.somedomain.com
Here is the htaccess rewrite that i am trying:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://www.%{HTTP_HOST}%{REQUEST_URI}
Edit:
I am using a cPanel server, so making additional hosts is not going to work.
I am trying to always redirect people to https://www.somedomain.com/URL
I think this is all you need:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*) https://www.somedomain.com/$1 [R=301,L,NC]
You'll want to not unconditionally add the www, if it already exists.
See: Prepend 'www' to an HTTPS url using .htaccess & mod_rewrite
Note that mod_rewrite is not the preferred way to do that. Using virtualhosts it's simpler. Just put this configuration (Source: apache wiki):
NameVirtualHost *:80
<VirtualHost *:80>
ServerName www.somedomain.com
Redirect permanent /secure https://www.somedomain.com
</VirtualHost>
<VirtualHost _default_:443>
ServerName www.somedomain.com
DocumentRoot /usr/local/apache2/htdocs
SSLEngine On
# etc...
</VirtualHost>

Redirect/rewrite alternative domains to root domain with apache2/htaccess

I 2 domains with and without the www prefix. When a user visits any of these domains, I want it to automatically reroute to a chosen 1 of them.
For example:
domain.com
www.domain.com
domain.co.uk
www.domain.co.uk
When a user visits www.domain.com, domain.co.uk or www.domain.co.uk, it will rewrite to domain.com
So far, I have my apache2 virtual host block setup like this:
<VirtualHost *:80>
ProxyPass / http://localhost:3060/
ProxyPassReverse / http://localhost:3060/
ServerName domain.com
ServerAlias www.domain.com
ServerAlias domain.co.uk
ServerAlias www.domain.co.uk
</VirtualHost>
But this doesn't do the rewriting/rerouting. I need to also make sure that it takes into account any paths. For example, www.domain.co.uk/test would change to domain.com/test
Any ideas how I can do this in the virtual host block? I'm assuming I would split the 3 domains to be rewritten into a separate block and treat them there, but really not sure how to accomplish all the rules I need.
Per your comment, you want to redirect the three aliases to the main domain, and you've stated that you would like to do this within the virtual host configuration.
<VirtualHost *:80>
...
RewriteEngine on
# If using one of the aliases ...
RewriteCond %{HTTP_HOST} ^www\.domain\.com$ [OR]
RewriteCond %{HTTP_HOST} ^(www\.)?domain\.co\.uk
# ... redirect to the main domain
RewriteRule ^(.*)$ http://domain.com/$1 [R=302,L]
</VirtualHost>
You can also add the Rewrite* directives in your domain's .htaccess file.
To make the redirect permanent, change 302 to 301 - this basically instructs browsers and search engines to cache the redirect.