Hi,
I've been trying to get one particular form to be in https - it's the only part of the site that needs to be encrypted because only that form submits anything personal (a credit card number). I tried secure_pages but it doesn't work, at least not on my installation. Besides, it slowed down my site significantly so I'd rather not use it. A much better solution would be to use rewrite rules to make it work properly - but I think I have a conflict with the drupal rewrite rules. I've gotten it close, but not quite working:
Basically it comes down to a single L which stands for "Last Rule" - if it's there it behaves half correctly and if it's not there it behaves half correctly - in the opposite way.
# REWRITE TO SSL if contact/requestBook
# WORKS AS EXPECTED ON IT'S OWN
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^(contact/requestBook)$ https://%{SERVER_NAME}/$1 [R=301,L]
# REWRITE TO NON-SSL if not contact/requestBook
# also ignore if a supporting file or else the page will display a broken lock
# IF [R=301,L] then any other page on https redirects to non-ssl fine but contact/requestBook redirects to
# http://s24863.gridserver.com/index.php?q=contact/requestBook
# IF you remove the L so it's [R=301] then contact/requestBook redirects fine but other pages stay on https and report Page not found
RewriteCond %{SERVER_PORT} ^443$
RewriteCond %{REQUEST_URI} !(contact/requestBook)
RewriteCond %{REQUEST_URI} !(.*css)
RewriteCond %{REQUEST_URI} !(.*js)
RewriteCond %{REQUEST_URI} !(.*jpg)
RewriteCond %{REQUEST_URI} !(.*gif)
RewriteCond %{REQUEST_URI} !(.*ico)
RewriteCond %{REQUEST_URI} !(.*png)
RewriteRule ^(.*)$ http://%{SERVER_NAME}/$1 [R=301]
# DRUPAL REWRITE
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
Thanks,
Sander
Comments
By the way
If you leave out these rewrite rules then all pages are accessible via both http and https without a problem.
Resolved
After days of messing with this I finally figured it out. It seems I needed to have the following lines in the non-ssl rewrite in order for it to work properly with the drupal rewrite already in place:
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
It now works so I wanted to post this for anyone else trying to get ssl working on only certain sections of their sites. Including the drupal rewrites already in .htaccess, my rewrites now look like this:
# REWRITE TO NONSSL UNLESS IT'S THE FORM, FORM EDIT/RESULTS PAGES
# OR SUPPORTING FILES
RewriteCond %{SERVER_PORT} ^443$
RewriteCond %{REQUEST_URI} !(contact/requestBook)
RewriteCond %{REQUEST_URI} !(node/387/*)
RewriteCond %{REQUEST_URI} !(.*css)
RewriteCond %{REQUEST_URI} !(.*js)
RewriteCond %{REQUEST_URI} !(.*gif)
RewriteCond %{REQUEST_URI} !(.*png)
RewriteCond %{REQUEST_URI} !(.*jpg)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ http://%{SERVER_NAME}/$1 [R=301,L]
# REWRITE TO SSL IF IT'S THIS FORM
RewriteCond %{SERVER_PORT} !^443$
RewriteCond %{REQUEST_URI} contact/requestBook
RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R=301,L]
# DRUPAL REWRITE
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?q=$1 [L,QSA]
Re: Resolved Rewrite to SSL
Hello,
It has been a while, so I hope you remember your posting on Drupal.
I am having problems with SecurePages too. So I started to go down the path of using .htaccess so things are more visible.
And your posting helped me so much. Thank you.
I am finding that when I am on a https page, when I post back to the server, I'm getting this message:
"Although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party. Are you sure you want to continue sending this information?"
So my data is being sent outside of the encrypted channel. Can you recommend a workaround ?
Joe
Thanks, your input really
Thanks, your input really saved me!