You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by sattlite Installer <sa...@hotmail.com> on 2010/09/15 13:55:20 UTC
[users@httpd] https and http server with the same documentRoot + force to use
https for some content and authenticate!
I have an 2.2 apache server with just 2 virtual servers, one for http and
one for https. The document root for the 2 is the same. I now need to
force users to use https for some parts of the site/tree as these will use auth directives in .htaccess files. However, I cannot
figure out how to do this.
The pages in question need to be protected by an auth directive which I
presume needs to be in the .htaccess of the directory holding the
pages. I have tried various combinations of the below but have not
found a combination that will apply redirection (to the https version) only to http requests
and authorisation only to https requests. I either get a redirection loop of authentication being applied to the http request then redirecting to https and requesting authentication again.
I have tried various combinations of the following:
redirects (which do not work as the 1st argument is the same for both http and https - ends up looping)
rewrites (which force on to https but before they are applied the
.htaccess processing of the auth diretives cuts in and wants to collect
user and password information over http)
Googleing does not help.
Can anyone suggest any routes to solve the problem
Regards
Sat
Re: [users@httpd] https and http server with the same documentRoot
+ force to use https for some content and authenticate!
Posted by Rainer Jung <ra...@kippdata.de>.
On 15.09.2010 18:11, Joost de Heer wrote:
> On 09/15/2010 05:55 PM, sattlite Installer wrote:
>> Thanks for the reply, then to confirm is there no way of doing this
>> only in
>> .htaccess files? I would prefer to do this as the web team edit these
>> while I
>> have to edit the server config?
>
> You need SSLRequireSSL
> (http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslrequiressl) which
> can be enabled in .htaccess.
Or if you want to redirect instead of presenting an error, add a
RewriteCond that checks "HTTPS".
See:
http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html#rewritecond
Regards,
Rainer
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] https and http server with the same documentRoot
+ force to use https for some content and authenticate!
Posted by Joost de Heer <jo...@sanguis.xs4all.nl>.
On 09/15/2010 05:55 PM, sattlite Installer wrote:
> Thanks for the reply, then to confirm is there no way of doing this only in
> .htaccess files? I would prefer to do this as the web team edit these while I
> have to edit the server config?
You need SSLRequireSSL
(http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslrequiressl) which can be
enabled in .htaccess.
Joost
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
RE: [users@httpd] https and http server with the same documentRoot
+ force to use https for some content and authenticate!
Posted by sattlite Installer <sa...@hotmail.com>.
Thanks for the reply, then to confirm is there no way of doing this only in .htaccess files? I would prefer to do this as the web team edit these while I have to edit the server config?
Thanks
sat
> Date: Wed, 15 Sep 2010 08:29:10 -0400
> From: covener@gmail.com
> To: users@httpd.apache.org
> Subject: Re: [users@httpd] https and http server with the same documentRoot + force to use https for some content and authenticate!
>
> > The pages in question need to be protected by an auth directive which I
> > presume needs to be in the .htaccess of the directory holding the pages.
>
> No, you can put these in your real Apache configuration enclosed in
> <virtualhost> and <directory>, which lets you limit them to the SSL or
> non-SSL vhost.
>
>
> --
> Eric Covener
> covener@gmail.com
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
Re: [users@httpd] https and http server with the same documentRoot +
force to use https for some content and authenticate!
Posted by Eric Covener <co...@gmail.com>.
> The pages in question need to be protected by an auth directive which I
> presume needs to be in the .htaccess of the directory holding the pages.
No, you can put these in your real Apache configuration enclosed in
<virtualhost> and <directory>, which lets you limit them to the SSL or
non-SSL vhost.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org