Question

I want to redirect users to the SSL secure server when they are accessing the ‘Account’ section of the site which will contain the forms for user profiles, settings, etc. However, I don’t want users being able to access the rest of the site on the SSL server. Because of how I coded my templates, I have my paths set as <a href="/about"> as an example. If they are in the Account section and click a link to the About section, they would still be on the secure https: connection. Obviously, I can just hard code the links to link to the http:// server, but I’m looking for alternatives.

So far I have the following in my .htaccess and it is working, but I’m wondering if this more resource intensive than it needs to be? Is it better to hardcode links to any of the other ‘non-account’ sections, or is doing this via .htaccess a good way to go about it?

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond $1 ^(account) [NC]
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

RewriteCond %{HTTPS} on
RewriteCond $1 ^(about|terms|products) [NC]
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Also, if I wanted to prevent the homepage from being accessed via https:// how would I go about adding that to my .htaccess file?

Answer 1

I would actually suggest to avoid to use rewrite rules for this.

The problem with rewrite rules that turn http requests into https requests is that they’re in fact redirections. This means that for every http request that is to be turned into an https request, the browser is first going to make the full http request (including content, cookies, except secure ones), get the redirection code from the server and then make the request again to the https re-written URL.

Although this is convenient, if you rely on this instead of making sure the links on your site that are intended to be to https sections are indeed using https, it will make it hard to detect when those link are incorrectly redirecting to the http variant.

The typical consequences are:

• mixed content warnings if you embed something using an http linked later turned automatically and transparently into https, which is a bad thing; and
• possible leakage of data.

Instead, I would suggest that you don’t use automatic rewrite/redirects and make sure the sections that are meant to be available via HTTPS only are not available at all on the plain HTTP variant (i.e. http://yourhost/account should return 404s): this will at least force you to notice when you’ve incorrectly linked and help you spot where you could have a security issue. Ultimately, although they share the same host name, an http site and and https site can have two distinct URL spaces: it’s not a bad thing in this context.

The only case I see where rewrites from http to https are really useful are when you want to make sure the user’s entry point to your site is redirected.

Rewrites from https to http don’t present this problem of course.