Rewrite rule for SSL and password protection

[sned]

Hello everyone, I am trying to write a rule to force redirection to https url, from an http rule. However the folder I want to use ssl for is also .htaccess password protected.

What I have now forces the password to be entered over an https connection, which I like:

SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire %{HTTP_HOST} eq "mysite.com"
AuthName "My Secret Folder"
AuthType Basic
AuthUserFile /var/www/html/folder/.htpasswd
require user myuser
ErrorDocument 403 [mysite.com...]

However, lots of people have bookmarked urls, and I have scripts that access the non-ssl site, with the password embedded into it (http://myuser:[e-mail]/folder/...)

Is there anyway to require SSL, but not force people to login twice? Ultimately, if I could get the ErrorDocument seen above to reflect the url that just came in, that would provide the result I want:

User logs in to [mysite.com...] is redirected to [mysite.com...] before they enter the password ...

Thanks!
-sned

[g1smd]

You MUST delete the protocol and domain name from the ErrorDocument directive.

As currently coded it returns a 302 redirect, not the correct 404 response.

[sned]

After another hour of googling, looks like this cannot be done in just .htaccess. So what I did is split it into two parts.

This is in my /folder/.htaccess:
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} folder
RewriteRule ^(.*)% [mysite.com...] [R,L]

Then in my ssl.conf file:
<Directory "/var/www/html/folder">
AuthName ...
AuthType Basic
AuthUserFile ....htpasswd
require user myuser
</Directory>
</Directory>

[g1smd]

You now have a 302 redirect. Is that what you really want?

Also, is ^(.*)% correct? Should that be ^(.*)$ or just (.*) instead?

Watch out for the duplicated </Directory> tag.