2

I need to be able to redirect a single page from standard http to https. For example, I want to go from http://domain.com/quote.php to https://domain.com/quote.php.

So far I'm using this code in my .htaccess file, and it's working for the initial redirect.

RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^quote.php https://domain.com/quote.php [R=301,L]

My problem, is that once I have visited the quote.php page and get redirected to the https version, all the other site pages I navigate to continue using the https protocol. This is a potential duplicate content issue, as I now have the same content accessible via http and https.

So what I want to do, is be able to do the above redirect, and then somehow do the same thing in reverse for all pages except quote.php. So if you attempted to access them via https, it would redirect to the default http version.

I use relative URLs throughout the site, so I can't simply hard-code in the https/http prefix. I need to be able to do this via .htacess, if possible.

Any help is greatly appreciated.

Jeremy
  • 1,141
  • 5
  • 20
  • 31
  • 1
    You might be interested in [this answer](http://stackoverflow.com/a/9105894/372643): using a redirect as you're planning to do is likely not to achieve the degree of security you would like. In addition, depending on whether your user is logged in, you may need to be careful as to what authentication token or session ID you share between the `http` and `https` variants. If you're user is doing something somewhat sensitive over `https`, there's no going back to plain `http`. – Bruno Mar 29 '12 at 17:55

1 Answers1

8
RewriteCond %{HTTPS}  off
RewriteRule  ^quote.php$  https://domain.com/quote.php  [R=301,L,QSA]

RewriteCond %{HTTPS}  on
RewriteCond %{REQUEST_URI}   !^/quote.php
RewriteRule  ^(.*)$  http://domain.com/$1  [R=301,L,QSA]

answer to comment: for adding new page to conndtions just put them parenthesis.like:

RewriteCond %{HTTPS}  off
RewriteRule  ^(quote|contact).php$  https://domain.com/$1.php  [R=301,L,QSA]

question 2: QSA flag add current query string to new URL. it happens by default except in case you change query string. You can delete them now safely but if you have added query string, and wanted to have old one too, put that back.

Edit 2:
code above has a little security issue :(, actually it's more than a little :-D. when you are using https to transfer html codes and page is using relative paths, so that's fine. but when you put these codes in .htaccess they turn into http and that's the problem:-). put the code below to sove the problem:):

RewriteCond %{HTTPS}  off
RewriteRule  ^(quote|contact).php$  https://domain.com/$1.php  [R=301,L,QSA]


RewriteCond %{HTTPS}  on
RewriteCond %{REQUEST_URI}   !^/(quote|contact).php
RewriteCond %{REQUEST_URI}   !^/(.*)\.(css|png|js|jpe?g|gif|bmp)$
RewriteRule  ^(.*)$  http://domain.com/$1  [R=301,L,QSA]

Now, all images,scripts,.. that you are using on secure pages, are transferring securely.

Jeremy
  • 1,141
  • 5
  • 20
  • 31
undone
  • 7,857
  • 4
  • 44
  • 69
  • Thank you, this appears to be working perfectly. Just a couple questions: 1. How would I add a second page to be included in the exclusive rewrite rules? For example, I also need to add https to contact.php in addition to quote.php. Is there some sort of "and" clause I can use here? Also, I'm familiar with R=301 and L, but what does the QSA flag do in this instance? – Jeremy Mar 28 '12 at 03:32
  • Thanks for the update. I have noticed that I'm getting a TON of mixed content errors from Chrome, IE, and Firefox. I have looked at all of the css, js and image urls, and they are all using relative urls, so I'm a little confused as to why these errors are showing up. These errors don't seem to be displaying when I don't have this .htaccess rewrite enabled. Do you think it could be causing those issues? – Jeremy Mar 28 '12 at 18:05
  • can you put HTML code of your page here( or in [http://jsfiddle.net/](http://jsfiddle.net/)) – undone Mar 29 '12 at 02:55
  • Thanks for all your help with this. This latest update (#3) has fixed the secure items issue, but now the SSL remains intact even when I visit another page that isn't either quote.php or contact.php. I need to rewrite to the http protocol for all other pages. – Jeremy Mar 29 '12 at 16:03
  • That works perfectly. Thanks! I think you have a minor code error on line 6 however, as you list `index|contact` rather than `quote|contact`. Thanks again for all the help. – Jeremy Mar 29 '12 at 21:49