RewriteCond for SSL login page

Use HTTPS for login, use HTTP after login

[sridharh]

I am new to this domain. We have an IBM HTTP Server (powered by apache) as a proxy for WebSphere Application Server. Application has been deployed and can be accessed from HTTP Server. We have a requirement to encrypt (SSL) initial login page of the application. Once Userid and Password gets validated system should resume back to normal http protocol. Our URL Pattern could be,

[<WebServer>...] (Initial login Page)

[<WebServer>...] (Application Pages)

I have written following rewrite rule, but it seems it doesnt work correctly.

<VirtualHost *:80>

RewriteEngine on
RewriteLog /opt/IBMIHS/logs/rewrite.txt
RewriteLogLevel 2

RewriteCond %{REQUEST_URI} ^/EMS_Web/$
RewriteRule /EMS_Web/* [webServer...] [R=301,L]

RewriteCond %{REQUEST_URI} ^/EMS
RewriteRule /EMS [webServer...] [R=301,L]

</VirtualHost>

When [webServer...] is requested, it is forwarded to [webServer...] but after login page all pages are still following https and not http.

Any help regarding this will be appreciated.

Thanks & Regards,

Sridhar H

[phranque]

RewriteCond %{REQUEST_URI} ^/EMS_Web/$
RewriteRule /EMS_Web/* [webServer...] [R=301,L]

RewriteCond %{REQUEST_URI} ^/EMS
RewriteRule /EMS [webServer...] [R=301,L]

you might try:
RewriteCond %{REQUEST_URI} ^/EMS_Web/$
RewriteRule /EMS_Web/.? [webServer...] [R=301,L]

RewriteCond %{REQUEST_URI} ^/EMS$
RewriteRule /EMS$ [webServer...] [R=301,L]

your first RewriteCond fails for any url that has /EMS_Web/something so it doesn't rewrite.
your use of the '*' in the first RewriteRule pattern is not taken as a wild card but rather as a quantifier, so i am not sure if you were doing that intentionally or just got lucky.
your pattern as written there means "/EMS_Web" followed by 0 or more "/".
if you had intended this to be a quantifier it would be slightly more precise to use the '?' for 0 or 1.
my suggested directives assume you were trying to wildcard here but if you were quantifying just remove the dot.
your second RewriteCond passes for any url that has /EMS(could-be-nothing-or-anything) so it rewrites pretty much every url in your examples except specifically /EMS_Web/ (which is the only url that passes and thus stops processing in the first RewriteCond ).

you didn't say what happens to the "/*" part of "http://<WebServer>/EMS_Web/*" when it rewrites, so i'm not sure i got it all right but i hope this helps...

[sridharh]

Thanks for your reply phranque,

your use of the '*' in the first RewriteRule pattern is not taken as a wild card but rather as a quantifier, so i am not sure if you were doing that intentionally or just got lucky.

Yes, it was my wild assumption to use '*' in that context. It needs to be a wild card rather as a quantifer.

I have tried your suggestions, but still nothing has changed.

my suggested directives assume you were trying to wildcard here but if you were quantifying just remove the dot.

But, nothing has happened. I have given a sample URL for your reference.

[webServer...]

After login page, this URL is suppose to be forwarded in standard protocol (not SSL)

Thanks & Regards,

Sridhar H

[phranque]

i would try using lwp-request or other tool to see the reponse status chain for possible hints:
lwp-request -S -d 'http://webServer/EMS_Web/sponsorRegistration.do;jsessionid=0000yc2ruXLrCTAiw-c7opOzQKX:11lcqkbok'
(i can't say for sure if apache will show all passes or only the final result.)
and in a blind flail i would also try switching the order of two tests.

[jdMorgan]

In order to avoid infinite redirection on both HTTP and HTTPS, you must check the current protocol. There are two ways to do this, but here's one that almost always works:

# If not HTTPS request
RewriteCond %{SERVER_PORT} !^443$
# redirect login requests to HTTPS
RewriteRule ^/EMS_Web/?$ https://webServer/EMS_Web/ [R=301,L]
#
# If HTTPS request
RewriteCond %{SERVER_PORT} ^443$
# redirect non-login requests to HTTP
RewriteRule ^/EMS/(.+)$ http://webServer/EMS_Web/$1 [R=301,L]

Without checking the current protocol, either one type of request or the other -or both- will always redirect for every request, leading to an 'infinite' loop.

Also, the 'quantifier' previously-discussed must be "one or more" and not "zero or more" to avoid ambiguity. Therefore, I have used ".+" instead of the ".*" pattern.

As shown, this code will only affect requests for resources in the "/EMS" directory-path, and will have no effect on other directory-paths or files in the Web-root directory.

The code above is for use in httpd.conf, conf.d, or other server config files, and will require modification for use in .htaccess -- the leading slashes on the RewriteRule patterns will need to be removed.

Jim