0

I'm using the rewrite rules below to redirect 2 php pages to https (to protect user data), but whenever I click on any links on those php pages they redirect with https enabled and the page does not display correctly.

The rules at the bottom were meant to redirect any other pages back to http, but they are not working. Any advice would be much appreciated!

    RewriteEngine on
    RewriteCond %{HTTPS} off
    RewriteCond %{REQUEST_URI} ^/securepage1.php$ [NC]
    RewriteRule ^(.*)$ https://www.example.com$1 [L,R=301]

    RewriteCond %{HTTPS} off
    RewriteCond %{REQUEST_URI} ^/securepage2.php$ [NC]
    RewriteRule ^(.*)$ https://www.example.com$1 [L,R=301]

    RewriteCond %{HTTPS} on
    RewriteCond %{REQUEST_URI} !^/securepage1.php$ [NC]
    RewriteCond %{REQUEST_URI} !^/securepage2.php$ [NC]
    RewriteRule ^(.*)$ http://www.example.com$1 [L,R=301]
user1684850
  • 11
  • 2

1 Answers1

1

Try enabling logging to get a clear idea of what steps are failing:

RewriteLog /path/to/log
RewriteLogLevel 2

You can use values greater than 2 for the log level, but keep in mind that this will affect your server's performance, so be wary of running this on a heavy production instance.

Now, for some security thoughts. If you're worried enough to protect the data on specific pages (but not others), then the best question to ask is: is it worth making only 2 pages on your site trust-worthy? If I navigate to http://example.com and get intercepted in a Man In the Middle (MIM) attack, does your user really care if https://example.com/securepage1.php is secure when the MIM attack has me going to http://badpage.com/securepage1.php? In other words, if this is part of an interactive site, protecting the two secure pages does nothing because the user can't actually trust the site from the start.

Andrew M.
  • 10,982
  • 2
  • 34
  • 29
  • Well, the main page is just regular content with links that go to the secure pages which are registration pages where users enter in their data. – user1684850 Jan 04 '13 at 22:26
  • Right, so the user logs in, gets a cookie set--and then goes back to a non-secure page, right? That cookie then gets sent over unencrypted channels--which means anybody could take it and become that user. It's a massive security hole. – Andrew M. Jan 06 '13 at 16:48
  • No, there is no log-in required on this site. The SSL is just to protect basic user information on registration pages for particular events. – user1684850 Jan 07 '13 at 17:52