0

For the past few hours (days) I have been having some trouble redirecting a page to SSL.

My setup is as follows: I have the following .htaccess for an e-commerce site on Apache 2.2.16 on Debian (all required mods enabled)

RewriteEngine On
RewriteBase /shop
RewriteCond $1 !^(index\.php|products|img|theme\.php|checkout\.php)
RewriteRule ^(.*)$ index.php?/$1 [L]

all requests are passed to index.php which acts as my controller and includes other .php files as necessary.

I now want to use HTTPS for the checkout process which is a php script cleverly called checkout.php

I thought it would be as easy as changing my .htaccess to:

RewriteEngine On
RewriteBase /shop
RewriteCond  %{SERVER_PORT} !^443$
RewriteCond %{SERVER_URI} checkout\.php
RewriteRule ^checkout.php?/$1 https://localhost/shop/checkout.php?/$1 [L,R]
RewriteCond $1 !^(index\.php|products|img|theme\.php|checkout\.php)
RewriteRule ^(.*)$ index.php?/$1 [L]

so that checkout.php is not processed by index.php. Apparently it is not that simple. I could probably do it by using a hardcoded https link to checkout but I would prefer to do it with mod_rewrite. If anyone can share some insight into this it would be really appreciated.

Thanks in advance

1
  • Instead of checking %{SERVER_PORT} try checking %{HTTPS}
    – Jon Lin
    Nov 17, 2011 at 18:12

1 Answer 1

0

There are a few problems. First, the pattern in your first RewriteRule

RewriteRule ^checkout.php?/$1   https://localhost/shop/checkout.php?/$1 [L,R]

is written incorrectly. $1 isn't meaningful there (it's a capture result, but no capture has happened yet), and also the query string (part of the request after the ?) isn't part of what's matched, as the RewriteRule documentation says.

Second, I think you meant to use REQUEST_URI instead of SERVER_URI.

So I think you want something like this:

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^/checkout\.php
RewriteRule .* https://localhost/shop/checkout.php [L,R]

RewriteCond %{REQUEST_URI} !^/(index\.php|products|img|theme\.php|checkout\.php)
RewriteRule ^(.*)$ /index.php?/$1 [L]

A few notes:

  • You don't need to match or add back in the query string in the first RewriteRule; mod_rewrite will automatically add it back in.
  • It's conventional to test RewriteCond %{HTTPS} off instead of RewriteCond %{SERVER_PORT} !443, as @Jon Lin suggests.
  • You may want to add the QSA flag in your second RewriteRule.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.