Redirect secure pages

[munkyonline]

I'm using drupal with the ubercart module. I've managed to get any urls going to /user /cart and /admin to 301 redirect to the HTTPS and then any pages containing /content /category /catalog to go to HTTP.

This is in my htaccess:
# Redirect pages to SSL and non-SSL to HTTP
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(user¦cart¦admin) [%{HTTP_HOST}%{REQUEST_URI}...] [R=301,L]
RewriteCond %{HTTPS} !=off
RewriteRule ^/?(content¦category¦catalog) [%{HTTP_HOST}%{REQUEST_URI}...] [R=301,L]

# Rewrite current-style URLs of the form 'index.php?q=x'.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

I wanted to know if it's possible to rewrite the second part of these rules so if the requested page is anything but /user /cart /admin then it goes to HTTP. This is because at current the root of the site isn't redirected to the HTTP.

Any help will be greatly appreciated!

[Caterham]

use the same regex from your 1st rule, but negate its result with an exclamation mark

RewriteRule !^/?(user¦cart¦admin) http...

[munkyonline]

Thanks for your reply!

I did try that earlier today as it seemed to be logical but it only works if you are on a https page and you navigate to a non https page.

If you are on http and want to go to /user it gets stuck in a redirect loop and goes to /index.php?q=user. Same with the /admin and /cart pages.

I think it's conflicting with this that was already in the htaccess before I amended it:

# Rewrite current-style URLs of the form 'index.php?q=x'.
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]

I'm a noob at this i've spent a couple of days already trying to work this out!

[Caterham]

So those "dirs" are never served but index.php?q=...

Exclude internal redirects and subrequest lookups

RewriteCond %{ENV:REDIRECT_STATUS} =""
RewriteCond %{HTTPS} =off
RewriteRule ^/?(user¦cart¦admin) [%{HTTP_HOST}%{REQUEST_URI}...] [R=301,L,NS]

RewriteCond %{ENV:REDIRECT_STATUS} =""
RewriteCond %{HTTPS} =on
RewriteRule !^/?(user¦cart¦admin) [%{HTTP_HOST}%{REQUEST_URI}...] [R=301,L,NS]

[edited by: jdMorgan at 2:15 pm (utc) on Jan. 27, 2009]
[edit reason] Corrected as noted in subsequent post [/edit]

[munkyonline]

That appears to have stopped all the redirects for HTTP and HTTPS so i dont think that worked

index.php?q=user is rewritten to /user

It is working just that there's no redirect to make https for the root of the site to go to http. I just wanted to cover that too to avoid duplicate content issues.

[Caterham]

the % is missing, sorry, my fingers were too fast for my keyboard.

RewriteCond [b]%[/b]{ENV...

[munkyonline]

OK I got different results from that, redirects are working from everywhere including the homepage but only away from HTTPS.

None of the /cart /admin or /user pages are redirected to HTTPS. If you add in the s manually in the address bar then these pages are redirected to HTTP like the other pages.

Could I possibly have them in the incorrect order?

[Caterham]

Did you replace the pipes (¦) with solid ones from your keyboard?

[jdMorgan]

Make sure you have replaced all broken pipe "¦" characters with solid pipes before use; Posting on this forum modifies the pipe characters.

Completely flush (or disable) your browser cache before testing new server-side code.

Some servers seem to work better using "RewriteCond %{SERVER_PORT} =443" instead of "RewriteCond %{HTTPS} =on"

Jim

[edited by: jdMorgan at 2:20 pm (utc) on Jan. 27, 2009]

[munkyonline]

Ah no I hadnt amended the pipes! Great that works perfectly!

Thanks ever so much for your help, much appreciated :)

[munkyonline]

Thought I better warn anyone that is also using ubercart - although the redirect works this caused an error on the SSL cert for the site and caused the ajax script to break in the Payment Method on the checkout, so I have reverted the htaccess file back.

This is due to an error in ubercart and how it processes the ajax - not with the rewrite code shown in this thread.

[jdMorgan]

You might be able to add specific URL-path exclusions to the redirects using RewriteConds, so that *most* SSL<->non-SSL canonicalization redirects will work, but it won't break your cart, SSL cert validation, or the AJAX scripts. Once (or if) they fix the scripts, you can remove these temporary RewriteConds.

Even if you can't fix all of the SSL<->non-SSL problems, fixing most of them will probably help a lot.

Jim

[munkyonline]

That sounds like a neat idea Jim, would you be able to give me an example condition that I could use please?