Redirection of secure subdomain

[Fish_Man]

Hello,

I have a secure subdomain of my site that is almost in exclusive use, ie. [subdomain.mysite.com...] (there is only one page in [mysite.com...] to redirect to subdomain)
What I would like, is for anyone who types:
mysite.com/subdomain/blahblah.....
or
www.mysite.com/subdomain/blahblah.....
or
[(either...] of the above)
or
basically ANYTHING that doesn't have the subdomain name at the start of the url,
to get automatically redirected to:
[subdomain.mysite.com...]
(AND if /subdomain/ is in the directory path to just ignore it)

One other problem at the moment (it is probably related) is that search engines are somehow finding and listing:
[subdomain.mysite.com...]
and
[subdomain.mysite.com...]

I have checked ALL links in ALL files to make sure that none of them have .../subdomain/... (although I almost exclusively use relative addressing)

Currently, my .htaccess in the root directory is:
# use utf-8
AddDefaultCharset utf-8
# disable all directory browsing
Options All -Indexes
IndexIgnore *

And my .htaccess in the subdomain directory is:
# force secure browsing
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^ [subdomain.mysite.com%{REQUEST_URI}...] [NS,R=301,L]

Please can anyone point me in the right direction?
Thanks & regards,

[jdMorgan]

In the main domain's top-level .htaccess, add:

RewriteCond %{HTTP_HOST} .
RewriteCond %{HTTP_HOST} !^subdomain\.example\.com
RewriteRule ^(subdomain)?(.*)$ https://subdomain.example.com/$2 [R=301,L]

In the subdomain's .htaccess file, add:

RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /subdomain/
RewriteCond %{HTTP_HOST} ^subdomain\.example\.com [NC]
RewriteRule ^subdomain/(.*)$ https://subdomain.example.com/$1 [R=301,L]

If the subdomain-subdirectory is present in the URL-path requested from any domain exceopt the subdoamin, it will be discarded by the first rule before the redirect to the subdomain.

If the subdomain is present in the URL-path requested by the client from the subdomain, then it will be discarded by the second rule.

Jim

[edited by: jdMorgan at 6:47 pm (utc) on Nov. 23, 2007]

[Fish_Man]

Hi Jim,
Thanks for the quick reply.
Do I add your code TO my subdomain's .htaccess file or INSTEAD of what I have for the 'force secure browsing' section?

Regards,

[jdMorgan]

"Add"

Jim

[Fish_Man]

Thanks for that, I'll give it a go and let you know.

Regards,

[Fish_Man]

That worked for most of the issues I had - Thank you very much.
There is just one small issue left, and that is
If you type:
[example.com...]
[example.com...]
[example.com...]
[example.com...]
It doesn't change the URL and returns a 'Certificate Error'

Can these be redirected, or am I being a bit too picky?

Regards,

[phranque]

welcome to WebmasterWorld [webmasterworld.com], Fish_Man!

check out some of the topics regard domain name canonicalization in the apache web server forum library [webmasterworld.com].

[Fish_Man]

Hi phranque,
Thanks for the welcome and the link to the topics. I have had a quick read, and unfortunately don't understand too much of it, but now I've bookmarked it, I can keep going back and having another read from time to time.

As you can probably tell by now, Apache & .htaccess are NOT my field of experience, which is why I came here, and why people with unusual fish health problems come to me - Go directly to the experts to have it explained in laymans terms and avoid disasters.

I appreciate that you do this out of the goodness of your hearts, and that I (we) should at least "have a go" before posting, and that is what I have done, but I have now gone way beyond my limited knowledge on this subject and was hoping that someone could help me out in this final little bit of my problem.

You see, I thought that my .htaccess in /subdomain/ that contains:
# force secure browsing
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^ [subdomain.mysite.com%{REQUEST_URI}...] [NS,R=301,L]

Forced ALL secure browsing TO [subdomain.mysite.com...] (but obviously not!)

Thanks again and Regards,

[jdMorgan]

If that code is in your subdomain's file space, then it will only affect requests made to that subdomain, leaving the code in your main domain's filespace to control any redirection needed when people access the main domain.

Jim

[Fish_Man]

Just noticed something...
At the moment, I have:
# force secure browsing
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^ [subdomain.mysite.com%{REQUEST_URI}...] [NS,R=301,L]
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /subdomain/
RewriteCond %{HTTP_HOST} ^subdomain\.example\.com [NC]
RewriteRule ^subdomain/(.*)$ [subdomain.example.com...] [R=301,L]

In line 4, should I be removing the 'L' as it isn't the last rule?

And, would lines 6&7 be better served with:
RewriteCond %{HTTP_HOST}!^subdomain\.example\.com$ [NC]
RewriteRule ^(.*)$ [subdomain.example.com...] [R=301,L]

(I think) saying that if I DON'T have "https://subdomain.example.com" then make it so (sorry a TNG fan as well)

Regards,

[Fish_Man]

Hi Jim,
Sorry, our posts must have crossed.....

Are you saying that I should have ALL my redirects in the root, and not in the subdomain?

Regards,
Paul

[jdMorgan]

You should have the rules that apply to your subdomain in the subdomain's folder, and the rules that apply to your main domain in the main domain's folder.

The [L] flag says, "If the patterns of this RewriteRule and its RewriteConds (if any) match, stop mod_rewrite processing here and apply the rule immediately."

Jim

[Fish_Man]

Hi,
This is probably where I am loosing the plot, because I don't really have a main domain, my site almost exclusively uses the secure subdomain, so I don't know what I should have in each area. I tried putting the:
# force secure browsing
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^ [subdomain.mysite.com%{REQUEST_URI}...] [NS,R=301,L]
in the root, but it didn't do what I expected (ie. force EVERYTHING to [subdomain.example.com)...]
I just don't know what I am supposed to put, where.....

Regards,

[Fish_Man]

Hi,
I have had a good read at various places on the 'net, and I don't really understand your statement:
<quote>
The [L] flag says, "If the patterns of this RewriteRule and its RewriteConds (if any) match, stop mod_rewrite processing here and apply the rule immediately."
</quote>
Because, in a section of "condition/rule code, by default it says - if the 'condition' exists, then perform the 'rule' if not carry on.
So, what is the difference in using the [L]?

Next, why doesn't the code I use work as expected? I believe I have said:
If the URL is being entered as a secure connection - then make it [subdomain.example.com...]
So why, when you type [example.com...] does it refuse to honour that statement and serve a page as [example.com...] with a 'certificate error' and not change it to [subdomain.example.com?...]

Regards,

[jdMorgan]

I'm afraid I can't explain the operation of the [L] flag any better than I already have -- without referring you to the mod_rewrite source code.

...why [...] does it refuse to honour that statement...?

Because SSL validation is processed before mod_rewrite and other Apache modules (for security reasons). So in order to avoid this cert error problem, you'll need two Certificates -- one for each domain. It is critical when using SSL to avoid links to the 'wrong' domain for this reason.

Jim