33

I have a Zend Framework application that I want to force into HTTPS using mod_rewrite. I am pretty lost when it comes to mod_rewrite. Here is my current .htaccess file in the root of my application.

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-s
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule !\.(html|htm|php|js|ico|gif|jpg|png|css|csv)$ /subdir/index.php

What is the best way to force the application into HTTPS based on what I have? I have tried a couple of the examples I found on here, but I keep getting redirect loops or internal server errors when I try them.

Thanks for your help!

1
  • 1
    Question has nothing to do with Zend Framework. Much mislead when you search for a zend solution on google. Should be renamed to "yet another mod_rewrite question"
    – Daniel W.
    Aug 5, 2014 at 11:34

4 Answers 4

81

The following solution works for both proxied and unproxied servers. So if you are using CloudFlare, AWS Elastic Load Balancing, Heroku, OpenShift or any other Cloud/PaaS solution and you are experiencing redirect loops with normal HTTPS redirects, give it a try.

RewriteEngine On

# If we receive a forwarded http request from a proxy...
RewriteCond %{HTTP:X-Forwarded-Proto} =http [OR]

# ...or just a plain old http request directly from the client
RewriteCond %{HTTP:X-Forwarded-Proto} =""
RewriteCond %{HTTPS} !=on

# Redirect to https version
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Put the rest of your rewrite rules here
9
  • 7
    Definite +1 for this answer when using Cloudflare flexible SSL; all other solutions seem to create redirect loops Dec 8, 2015 at 15:56
  • Worked on a wordpress site where only the home page was forcing https while for other pages http was being allowed. Note : I had to put this code BEFORE the # BEGIN WordPress in .htaccess to get it to work.
    – Nikhil VJ
    Oct 11, 2017 at 4:42
  • This is what you need for AWS loadbalancer too Mar 1, 2018 at 19:16
  • I am using CloudFlare, and want to redirect WWW to NON-WWW and HTTP to HTTPS, any ideas?
    – RRN
    Aug 21, 2018 at 12:56
  • 1
    @raphinesse Do you know why normal redirect would cause redirect loops?
    – RRN
    Aug 22, 2018 at 3:46
37

Put this rule before your current rules:

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
1
  • 1
    The Point to note here is "Put this rule before your current rules". Make this as the first rule. My site was having several redirect rules and making this rule as the first one did the trick. Aug 3, 2014 at 10:20
5

I was looking for this solution as well. I added Gumbo's solutions and it worked great for me. But my original was different. My site/app rewrite redirects everything through index.php (for fany urls and ../application) except for files you request specifically. (like an image or other static files in the public root) Here's my original, which I found off the ZF site a long time ago.

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]

Here's with Gumbo's additional rules to force SSL on the whole site. So far works good for me.

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]
2

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^.*$ https://mydomain.com/\0 [L,QSA,R=301]