Question

I have an Zend Application that generate URL like that

http://miapp.com/module/controller/action/params/values

I want to exclude from SSL a certain URL that has a param (print or download)

Actually i have this .htaccess params to redirect ALL request over SSL and generate Dynamic URL rewrite

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{REQUEST_FILENAME} !-s     
RewriteCond %{REQUEST_FILENAME} !-l     
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^.*$ /index.php [NC,L]
php_flag display_startup_errors off
php_flag display_errors off
php_flag html_errors off

But how can i exclude the URLS that’s contain print or download?

y try something like that 🙁 but i got redirect looping error

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_REFERER} !^https(.*)/(print|download)(.*)$ [NC]
RewriteCond %{REQUEST_URI} !^(.*)/(print|download)(.*)$ [NC]
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]
RewriteCond %{REQUEST_FILENAME} !-s     
RewriteCond %{REQUEST_FILENAME} !-l     
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^.*$ /index.php [NC,L]
php_flag display_startup_errors off
php_flag display_errors off
php_flag html_errors off

Answer 1

There is usually as misconception about rewrite rules in that they are done inside the web server. This is true as long as there are no redirects involved in the rewrite rules. A redirect returns a redirect with a new URL and STATUS CODE 3xx to the browser.

With your second htaccess you have two redirects. Your first rule tells the browser “Dude, use SSL. Try again”. If the request is not HTTPS the connection is terminated after a 301 status code is returned with the new URL to the client. No more lines are processed in the htaccess file. The browser has to send a new request to the server.

Here’s a bonus if your first sentence is correct and you create URLs in Zend Framework without https. If you do that you are basically generating a whole lot of traffic because each and every request with your links is 301 redirected, i.e. returned and resend by a browser. You should create your URLs in Zend with https to avoid that.

Now about your second rule. This rule tells the browser “Dude, your path contains print or download you don’t need HTTPS. Try again.” As above the connection is now terminated and no more lines are processed in the htaccess file. Of course, this new request will bang its head on your first rule which will end in your mentioned loop.

Now all you really need is this, I believe (I can’t test it). You include the print|download as an exception into your HTTPS condition.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_REFERER} !^https(.*)/(print|download)(.*)$ [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]

In your Zend Application you will have to make sure that your link is only HTTP, though. Not for the rewrite rules to work but your IE requests.