Conditional redirects to https and back to http

openSUSE, SSL - secure.example.org, default-server.conf, optimize, secure

[tpeacock]

Greetings,

I am new to WebmasterWorld.com and came here to concentrate on my own sites but the questions below are for a non-profit company I’m associated with whose hosting and support could not pay their bills a few months ago and I put their content into a popular CMS but still have some outstanding issues I need help with.

I am trying to get everything on the donate page www.example.org/index.php?
option=com_donate&task=authorizenetonce... and in folder www.example.org/administrator/ to be redirected to secure.example.org and everything else to run on www.example.org.

I have been able to get both the directory and the donate page to switch over to https (with separate Rewrite Rules) but could not get them to switch back. I wanted to try and optimize them into a single conditions that I have below to https and back to http but I have not checked this code on the server yet.

Am I on the right track with the syntax? Is there a more efficient, secure way to code this?

DocumentRoot "/srv/www/htdocs"
Options +FollowSymLinks
RewriteEngine on

# Redirect non-https requests for SSL URL paths to https
RewriteCond %{server_port} ^80$
RewriteCond %{REQUEST_URI} ^/(administrator/?¦index/.php/?option=com_donate/&task=authorizenetonce$)
RewriteRule ^/(.*)$ [secure.example.org...] [R=301,L]

# Redirect https requests for non-SSL URL paths to http
RewriteCond %{server_port} ^443$
RewriteCond %{REQUEST_URI} !^/(administrator/?¦index/.php/?option=com_donate/&task=authorizenetonce$)
RewriteRule ^/(.*)$ http://www.example.org/$1 [R=301,L]

# Canonicalize domain
Rewritecond %{HTTP_HOST} ^example\.org
RewriteRule ^/(.*)$ http://www.example.org/$1 [R=301,L]

Thanks,
Thomas

[jdMorgan]

I'd suggest:

# Redirect non-https requests for SSL URL paths to https
RewriteCond %{SERVER_PORT} !=443
RewriteCond %{REQUEST_URI} ^/administrator/? [OR]
RewriteCond %{REQUEST_URI}>%{QUERY_STRING} =index.php>option=com_donate/&task=authorizenetonce
RewriteRule ^/(.*)$ https://secure.example.org/$1 [R=301,L]
#
# Redirect https requests for non-SSL URL paths to http
RewriteCond %{SERVER_PORT} =443
RewriteCond %{REQUEST_URI} !^/administrator/?
RewriteCond %{REQUEST_URI}>%{QUERY_STRING} !=/index.php>option=com_donate/&task=authorizenetonce
RewriteRule ^/(.*)$ http://www.example.org/$1 [R=301,L]
#
# Canonicalize domain, preserving HTTP/HTTPS protocol
Rewritecond %{SERVER_PORT}s>%{HTTP_HOST} ^(443(s)¦[0-9]+)>example\.org
RewriteRule ^/(.*)$ http%2://www.example.org/$1 [R=301,L]

Note that I used non-regular-expressions exact-string compares where possible for performance.

Important: Replace the broken pipe "¦" character in the last rule's RewriteCond pattern with a solid pipe character before use; Posting on this forum modifies the pipe characters.

The ">" character used in several of the RewriteConds above is arbitrary. While it intentionally implies concatenation, it serves only as a non-ambiguous delimiter between the multiple variable values to be matched by the RewriteCond.

The modification to your last rule is not strictly required, but it prevents an unnecessary second "chained" or "stacked" redirect when an HTTPS page is requested using the right protocol but a non-canonical domain. For example, if "https://example.com/adminstrator/" is requested, the first two rules would be bypassed, and your existing third rule would redirect to http://www.example.com/administrator. So the hostname would be corrected to "www", but the protocol would now be wrong. So, the client would then get a second redirect from your first rule to set the protocol back to HTTPS.

Jim

[edited by: jdMorgan at 7:35 pm (utc) on May 12, 2009]