By webdev2 on

I have used Secure Pages module but it's actions not consistent across browsers.

Does mod_rewrite in the .htaccess file work for drupal? If so, do I change the file in web root?

Thanks.

⋅ Categories: Drupal 5.x

Comments

webdev2’s picture

webdev2 commented

please disregard. I got it working in .htaccess with:

RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

to refer the entire site to use ssl.

pimok3000’s picture

pimok3000 commented

Thanks a lot, the fact you posted a solution saved me a lot of pain!

Best Regards
Torsten Zenk

Open-Consult.NET

webdev2’s picture

webdev2 commented

I'm glad I can finally help someone since so many have helped me here. You're very welcome.

idontunderstand’s picture

idontunderstand commented

can you help me to find exactly where i need to edit the .htaccess file and what i need to write....

joe4’s picture

joe4 commented

You edit the .htaccess file located in your root Drupal folder. Here is a example on how to make some pages SSL and others not SSL without using the secure pages module. http://www.runssl.com/content/how-redirect-drupal-or-ubercart-ssl-connec...

It was written for Ubercart but you can make some small changes to have it redirect by taxonomy.

EmanueleQuinto’s picture

EmanueleQuinto commented

Given that the link above is not working anymore this is my suggestion to secure pages (in this case user, user/login and donate/*)

  # 1) https: rewrite rule for donations (clean url)
  RewriteCond %{SERVER_PORT} !^443$
  RewriteRule donate(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

  # 2) https: rewrite rule for login (clean url)
  RewriteCond %{SERVER_PORT} !^443$
  RewriteRule ^user https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

  # 3) https: rewrite rule for login and donation (NOT clean url)
  RewriteCond %{SERVER_PORT} !^443$
  RewriteCond %{QUERY_STRING} donate/(.*)$ [OR]
  RewriteCond %{QUERY_STRING} user$ [OR]
  RewriteCond %{QUERY_STRING} user/login$
  RewriteRule (.*)  https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

  # 4) http: rewrite rule for other pages (redirect to http)
  RewriteCond %{SERVER_PORT} ^443$
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} !donate(.*)$
  RewriteCond %{REQUEST_URI} !user
  RewriteRule (.*)  http://%{SERVER_NAME}%{REQUEST_URI} [L,R]

First and second block set rules for clean url:
http://www.example.com/user to https://www.example.com/user

Third block check for not clean url (the path is in the query and it works either with and without leading slash):
http://www.example.com/index.php?q=user to https://www.example.com/index.php?q=user
http://www.example.com/index.php?q=/user to https://www.example.com/index.php?q=/user

Fourth block redirect to http other pages:
https://www.example.com/node to http://www.example.com/node

Check:
http://www.jonathandean.com/2009/03/apache-rewrite-rules-to-force-secure...

webdev2’s picture

webdev2 commented

wow - that is one of the best posts/answers ever. Many thanks!!

executex’s picture

executex commented

Do not use mod_rewrite in .htaccess for SSL redirections.

This will cause errors in certain pages of drupal_json() or drupal_to_js() AJAX responses.
The result will be javascript alert popup saying HTTP error 0 occurred, because of a HTTP 302 response (to move user from http:// to https://)

Instead use secure pages module, or try adding a $base_url to settings.php.