zf2 - Force SSL/https using .htaccess

Question

I have followed this question and also this question But didn't helped me much.

I'm on Zend Framework2

I'm getting page is not redirecting properly error.

This is my .htaccess file,

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteCond %{REQUEST_URI}::$1 ^(/.+)(.+)::\2$
RewriteRule ^(.*) - [E=BASE:%1]
RewriteCond $1 !^(index\.php|robots\.txt|(.*).gif|(.*).jpg|(.*).png|(.*).jpeg|(.*).GIF|(.*).JPG|(.*).PNG|(.*).JPEG|upload|(.*).js|(.*).css)
RewriteRule ^(.*)$ %{ENV:BASE}index.php [NC,L]

<IfModule mod_deflate.c>
<IfModule mod_setenvif.c>
<IfModule mod_headers.c>
SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X~-]{4,13}$ HAVE_Accept-Encoding
RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
</IfModule>
</IfModule>

<IfModule mod_filter.c>
AddOutputFilterByType DEFLATE application/atom+xml \
application/javascript \
application/json \
application/rss+xml \
application/vnd.ms-fontobject \
application/x-font-ttf \
application/x-web-app-manifest+json \
application/xhtml+xml \
application/xml \
font/opentype \
image/svg+xml \
image/x-icon \
text/css \
text/html \
text/plain \
text/x-component \
text/xml
</IfModule>
</IfModule>

<IfModule mod_php5.c>
    #Session timeout 90 days - 7776000
    php_value session.cookie_lifetime 7776000
    php_value session.gc_maxlifetime 7776000
</IfModule>

I have added this at the starting of the .htaccess file,

RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

But didn't worked for me.

What am I doing wrong?

Edit - Apache version is 2.2.15.

Are you behind a load balancer that's doing the tls/ssl termination for you? — brutuscat, Apr 07 '17 at 14:58
@brutuscat I don't know about that. How to check it please help.. — Keyur, Apr 08 '17 at 05:08

score 1 · Answer 1 · edited May 23 '17 at 11:54

1

Favori solution.

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
    RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
    RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
</IfModule>

A nice answer Best Practice: 301 Redirect HTTP to HTTPS (Standard Domain)

edited May 23 '17 at 11:54

Community

1
1

answered Apr 11 '17 at 19:41

Scaffold

587
6
14

I've tested your solution. Works like a charm. – Sébastien Gicquel Oct 24 '18 at 08:57

score 0 · Answer 2 · answered Apr 05 '17 at 05:14

0

Try using in htaccess

RewriteCond %{HTTP_HOST} ^example.net$ [NC]
RewriteRule (.*) https://www.example.net/$1 [R=301,L]

or just add an function to your bootstrap file

    protected function _initForceSSL() {
    if($_SERVER['SERVER_PORT'] != '443') {
        header('Location: https://' . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
        exit();
    }
}

answered Apr 05 '17 at 05:14

Aniket Singh

857
4
16
39

Tried both ways. Still getting the same error. `page is not redirecting properly` – Keyur Apr 05 '17 at 05:34
try to change the environment of the project where `APP_URL=http://example.com` into https – Aniket Singh Apr 05 '17 at 06:27
We do not have declared this type of `APP_URL` in any of the configuration file. – Keyur Apr 05 '17 at 06:33

score 0 · Answer 3 · answered Apr 06 '17 at 11:31

0

Have you tried this?

RewriteBase /
RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

answered Apr 06 '17 at 11:31

rmondesilva

1,732
3
17
29

It is not forcing ssl. (Tested by clearing browser cache/cookies.) – Keyur Apr 06 '17 at 12:00

score 0 · Answer 4 · answered Apr 07 '17 at 08:51

0

You can try this

#Rewrite to HTTPS
RewriteCond %{HTTPS} off
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This worked for me.

answered Apr 07 '17 at 08:51

Anubhav Gupta

102
9

score 0 · Answer 5 · answered Apr 10 '17 at 19:16

To force all web traffic to use HTTPS insert the following lines of code in the .htaccess file in your website’s root folder.

Important: If you have existing code in your .htacess, add this above where there are already rules with a similar starting prefix.

To force a specific domain to use HTTPS, use the following lines of code in the .htaccess file in your website's root folder:

RewriteEngine On 
RewriteCond %{HTTP_HOST} ^example\.com [NC]
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

Make sure to replace example.com with the domain name you're trying force to https. Additionally, you need to replace www.example.com with your actual domain name.

If you want to force SSL on a specific folder you can insert the code below into a .htaccess file placed in that specific folder:

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80 
RewriteCond %{REQUEST_URI} folder 
RewriteRule ^(.*)$ https://www.example.com/folder/$1 [R,L]

Make sure you change the folder reference to the actual folder name. Then be sure to replace www.example.com/folder with your actual domain name and folder you want to force the SSL on.

zf2 - Force SSL/https using .htaccess

5 Answers5