apache HTTP:X-Forwarded-Proto in .htaccess is causing redirect loop in dev environment

Question

I've had to update my .htaccess from this:

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

to this:

RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

to get it working behind an AWS Elasic Load Balancer.

It all seems to work fine on AWS, but in my local environment I'm stuck in a redirect loop.

How I can get this setup to work correctly in both environments?

Are you running your local Apache server as a reverse proxy/load balancer? Have you set `RequestHeader set X-Forwarded-Proto "https"` in your local VirtualHost configuration? — kums, Oct 29 '14 at 02:24

anubhava · Accepted Answer · 2014-10-29T16:29:11.283

117

To make it work in both environments you can combine both conditions:

RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]

edited Oct 29 '14 at 16:29

answered Oct 29 '14 at 05:15

anubhava

3

This actually works without the [OR], but with it it causes the redirect loop. – greg Oct 29 '14 at 16:28
This works for my homepage `http://www.ex.com redirects to https` but if somebody goes to a direct page ``http://www.ex.com/about` doesn't redirect to https. I am behind an AWS load balancer – Matt Winer Feb 14 '17 at 19:31
1

You are the winner bro!! – David Okwii Jun 20 '17 at 08:56
2

Just make sure that, if you using loadbalancer, you getting X-Forwarded-Proto – fearis Jun 21 '17 at 08:53
What's the NE (noescape) flag for in this case please? – Mere Development Nov 29 '21 at 10:36

Nick Kovalsky · Answer 2 · 2018-08-08T16:48:52.453

2

I had a special case for a shared hosting (masterhost), everything was failing except:

  RewriteCond %{HTTP:X-Forwarded-Port} !443
  RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

edited Aug 08 '18 at 16:48

answered Apr 10 '18 at 17:46

Nick Kovalsky

2 Answers2