Redirect to WWW and secure connection

[flycast]

I am trying to write mod_rewrite code to redirect a request if it contains a phrase to a secure connection...no problem. The part I am struggling with is how to add the WWW into the url if it does not exist without hardcoding the domain name into the code. In other words I am looking to make this a template for all websites that are created on a server. Here is where I am currently at:

#Redirects admin pages to a secure connection
RewriteCond %{REQUEST_URI} /(eeadmin)
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(.*)$ [domain.com%{REQUEST_URI}...] [R=301,L]

This works except that I have to hardcode the domain name. Furthermore, I have poked around and looked at using variables:
HTTP_HOST
SERVER_NAME

and they change depending upon what was keyed into the address box. If "www" was keyed in then these variables hae "WWW" if not then these variables do not.

How Do I get this done?

[jdMorgan]

From your description, it sound like you're looking for something like this:

# Redirect admin pages to a secure connection
RewriteCond %{SERVER_PORT} !=443
RewriteCond %{HTTP_HOST} ^(www\.)?([^.]+(\.[^.:]+)+)\.?(:[0-9]+)?$
RewriteRule ^(eeadmin.*)$ https://www.%2/$1 [R=301,L]

Note the several tweaks for efficiency.

The 'extra stuff' at the end of the hostname pattern is to handle (and drop) FQDN hostname indicators and appended port numbers, for example, a request for the valid-but non-canonical URL http://example.com.:80/eedamin/<whatever> will be properly redirected to [example.com...]

Also note that you should likely add another rule (where you add it depends on your server configuration) to redirect all non-eeadmin requests from https back to http, except for images, scripts, etc. that are 'shared' between http and https pages.

The code above is for use in .htaccess or in a <Directory> container in a server config file. If the code is located in some other place, then you'll need to add a leading slash to the RewriteRule pattern, outside of the parentheses. IOW, the pattern would need to be "^/(eeadmin.*)$"

After adding an https->http canonicalization rule, you might also want to add an overall hostname canonicalization rule. The code for doing that while preserving the http/https protocol has been posted in this forum several times, and can be found with a search on "canonical redirect https preserving host" or similar.

Jim

[flycast]

jdMorgan:

Thanks for the awesome response. I guess that my first statement is...why does mod_rewrite have to be so hard?

I have been testing this. It works great except I didn't think about when I have subdomains. If there is a subdomain it still places the www in front of the subdomain.

You have a good point about switching back to port 80 if the request does not need ssl.

Thanks...

[g1smd]

Mod_rewrite is "so hard" because it is server configuration code.

It isn't a 'programming language'. It has to be compact, lightweight, and efficient, by design. That unfortunately also makes it more difficult to understand.

[jdMorgan]

> If there is a subdomain it still places the www in front of the subdomain.

Please post several examples of hostnames with and without subdomains (and sub-sub-domains if you use any) using "example.com" as a base domain, and specify which forms should be redirected and which should not.

Note that you do not need to address the protocol or the URL-path. We just need examples of hostnames.

If you are using both "example.com"-type domains and cctld domains such as "example.co.uk", we need to know that, too. The complexity and inefficiency of the required code goes way up if many different cases must be handled.

Jim

[flycast]

Wow. Thanks.

www.example.com
www.example.org
sub.example.com
sub.example.org

No sub-sub domains and no cctld domains.

[jdMorgan]

OK, so that allows the simplest hostname matching pattern.

# Redirect admin pages to a secure connection
RewriteCond %{SERVER_PORT} !=443
RewriteCond %{HTTP_HOST} ^(www\.)?([^.]+\.[^.:]+)\.?(:[0-9]+)?$
RewriteRule ^(eeadmin.*)$ https://www.%2/$1 [R=301,L]

Now you need to think about the "other direction" -- What do you do if a non-eeadmin resource is requested using https? You should redirect these requests back to http in order to avoid duplicate content.

And there is another fly in the ointment here, because you'll also likely have resources such as images, stylesheets, and possibly external Javascript files that are "shared" by both http and https. The URL-paths for those resources must be excluded from the https-to-http redirect.

Jim