Add www to URL for live site, but not on local or staging URLs

[stemc]

Hi there,

I want to use a rewrite rule to ensure that 'www' is always in a live site's URL. I'd normally use the following:

RewriteEngine On

# Add www
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

However, this particular website has a live URL (http://www.mywebsite.com), a staging URL (http://mywebsite.stagingserver.com), and a local development URL (http://mywebsite.dev).

I'd like to use the same .htaccesss file/rules on the local, staging and live sites (so I can version control this file in multiple environments), so I was hoping that I could enforce the 'add www' rule only for the live site (as adding 'www' to the local or staging URLs breaks the site). So I've came up with this:

RewriteEngine On

# Add www
RewriteCond %{HTTP_HOST} !(mywebsite.dev|stagingserver.com)
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

It seems to work (as far as I can tell), but can anyone tell me of anything better than I could be using instead please?

Thanks,

Stephen

[lucy24]

Using %{HTTP_HOST} in the target is never a first choice. Do all three sites pass through the same htaccess in spite of the different hostnames? Are they the only sites using this htaccess? If so, why not use the ordinary canonicalization redirect with an extra condition

RewriteCond %{HTTP_HOST} !^(www\.example\.com)?$
RewriteCond %{HTTP_HOST} !(\.dev|staging)
RewriteRule (.*) http://www.example.com/$1 [R=301,L]

Ordinarily, conditions would be listed in the order of "most likely to fail". Here this coincides with logical order: it doesn't matter if the requested host is {development site or staging site} unless you have already established that it is not {public site} -- a condition that will usually fail. In the second condition, anchors probably aren't necessary. That's assuming that each of the two exempt sitenames contains some element that doesn't occur in the public sitename.

Do you have other security measures elsewhere? There's got to be some way to prevent people from walking in off the street and asking for your development site if they happen to learn its name.

[g1smd]

That's exactly how I would do it.

[stemc]

Thanks for the reply, Lucy.

At the moment, I have a different .htaccess file for each development environment (local, staging, live), and have this file kept outside of my Git version control. But I'd like to start using the same .htaccess file for all three environments and get this file inside my version control workflow. So this is why I posted here about it, as it's only the 'www' rule that's stopping me from being able to do so. Also, each environment is on a different server, and the staging site is password protected (not that there's anything mission critical to worry about if someone had access to it, as there's are just brochure sites).

I prefer not to have the live domain name (www.example.com in your example) in the .htaccess rule as this means it is yet another thing that needs to be changed for every website project. It's nice when you can have a set of generic rules that are the same across multiple projects, so you don't have to even touch the .htaccess file when starting a new site.

Do you know if there are any performance reasons to go with what you've suggested rather than what I posted in the original thread? As you can see, my main reluctance to go with this is that it's yet another thing to maintain on a per-site basis (lame, but it all adds up!).

Thanks,

Stephen

[lucy24]

each environment is on a different server

Then they cannot share an htaccess file, unless you're got heavy-duty proxying in place. Do requests to all names get sent to the same place, and then a proxy sends some of them out to other servers? If each name has its own DNS settings, then htaccess is not a possibility. (It could still be done if all three shared a directory on the same server-- same setup as a "userspace" on shared hosting.)

If everything does share an htaccess:

Your original version works if you can be 100% certain that
#1 you will never get a request with appended port number, where "you will never get" can mean either "no one will make" or "the server will not hear"
#2 you are prepared to dismiss requests arriving via HTTP/1.0, which doesn't include a hostname (so all requests would go into an infinite loop)

No matter how you word it, the rule only executes if the conditions are met-- that is, the request is for either the wrong name or a non-public version of the site. So I don't think the performance question is major enough to worry about. Unless you've got a test site where vast numbers of users are active nonstop. Then maybe.

[g1smd]

By "share the same .htaccess file", I think that "I want to upload an identical .htaccess file to each server without editing it each time" was meant.

[lucy24]

Oh. Oops. World of difference!

[stemc]

Yes, when I said, "I'd like to start using the same .htaccess file for all three environments and get this file inside my version control workflow," I was talking about using an identical .htaccess file in each of the development environments.

Thanks for your help in this thread, it's much appreciated! :)

Thanks,

Stephen