Mod_rewrite from http:// to https://

[Kunju]

Hi!

I've been trying to redirect a page to a secure SSL connection when a user types http:// instead of https:// but so far I still keep getting a Server Error! Error 500 message. My configuration files are as follows:

TO ALLOW FOR MOD_REWRITE (httpd)
------------------------

<Directory "C:/xampp/htdocs">
Options +FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>

TO SECURE SSL ON FOLDER (httpd)
-----------------------

<Directory "C:/xampp/htdocs/login/SSL/">
SSLRequireSSL
</Directory>

And finally my .htaccess file is as follows:

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} SSL
RewriteRule ^(.*)$ https://localhost/login/SSL/$1 [R,L]

Now, I've implemented mod_rewrite for another page so I know that for sure works. Also, without the .htaccess file in "C:\xampp\htdocs\login\SSL" I get a message that Access is forbidden to that page (which is actually index.php) thus illustrating that SSL has been secured for the named folder. I've saved the .htaccess file in "C:\xampp\htdocs\login\SSL" and so am thinking I've done everything correctly but the error keeps being diplayed. Can someone aid me in correcting the error in my logic, Thanks.

[Izzy]

Server 500 errors are explained in the C:\xampp\apache\logs\error.log file.

TO ALLOW FOR MOD_REWRITE (httpd)
------------------------

<Directory "C:/xampp/htdocs">
Options +FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>

This is the default settings anyway in the httpd.conf file.

Try and add after RewriteEngine On:
RewriteBase /login/SSL

[Kunju]

Thanks for the try, but unfortunately that didn't work either.

[Izzy]

Yes you missed this

Server 500 errors are explained in the C:\xampp\apache\logs\error.log file.

[Kunju]

Sorry about that; I realised my mistake after I had posted. The error log says I have an Invalid command ... , perhaps misspelled or defined by a module not included in the server configuration. I hope this can give more clarity.

[Izzy]

I don't know what version of Windows or what version of XAMPP you are using.

Make sure in your httpd.conf file that this line is uncommented so it looks like this:
LoadModule rewrite_module modules/mod_rewrite.so

If you have to remove the comment (#) then save the file and restart Apache.


Check your .htaccess for correct commands as the error message indicates but the error usually means the above module is not loading.

[Kunju]

I'm afraid you're right. I'm on XAMPP version 1.7.0 & when I tried to run a simple mod_rewrite for another page it failed; but the mod_rewrite module definately doesn't have a hash at the beginning in the httpd.conf file. So am thinking I might have to re-install XAMPP, or might you have any other suggestions?

[Izzy]

Paste the simple mod_rewrite rule you tested that failed and I will test it on my 1.7.0 default (out of the box) installation test bed to see if you need to do a fresh install - include any details you think I should know to help get it to work.


BTW did you check the error.log again after running the second test .htaccess file?

In this .htaccess file that keeps failing mod_rewrite has it any other content?

You created the .htaccess file with a text editor and not a word processor?

Edit
If it helps and I hope you don't flip your lid, I just tested your original .htaccess you posted by creating the folders C:\xampp\htdocs\login\SSL and I included in the SSL folder the .htaccess file and a copy of the index.html that is in the htdocs folder.

I then went to http://localhost/login/SSL/ and was given the index.html (It works!) and in the address bar of my browser it had changed to https://localhost/login/SSL - no errors period.

So it would seem that your .htaccess file is fine and the placement is fine so the conclusion is that your XAMPP installation may have a leak, chucked a wobbly or perhaps some of your conf file edits are at fault.


Read the readme_en.txt file about uninstalling and installing but this time try the EXE (7zip) version then follow the instruction in the readme file to run the setup_xampp.bat file.

This time test your .htaccess file without making any changes to the installation configuration files, in other words run it as a default clean (out of the box) installation - that's how I tested it and it worked.

[Kunju]

Thanks alot for your help Izzy. Re-installation didn't solve the problem but at least the fact the logic of the .htaccess was correct can be of some help to forum members & myself in future.

[Wiedmann]

Re-installation didn't solve the problem

Which problem?

Sorry, after reading this thread, it's not clear for me, what's the current state of your problem:
- Your current server configuration.
- The error message you get at the moment. (You can't have an error 500 and error 401 at the same time, like you wrote in your first post)

[Kunju]

Just for clarification, my initial error was essentially with regard to the failure to execute mod_rewrite statements in a .htaccess file (Error 500). I indicated the error 403 to illustrate that the folder "c:/xampp/htdocs/login/SSL/" exclusively uses SSL encryption and thus when you use http: instead of https: you get the aforementioned error. As a way to remedy this I wanted it to be possible to convert http: to https: automatically when the browser detects a http: request when infact it should be a https: & thus a user would be redirected appropriately. As Izzy has shown, the problem is not with the logic of the .htaccess file but with my config files. My current error is actually error 403; the log says - reason: SSL connection required, almost as if the .htaccess file is being ignored. At this point am stumped; but if you would like to look into it more I can attach the conf files that I have edited as well as an additional info on how my files are organised. However, having said this, its strange that a mod_write is working for another folder.

[Wiedmann]

Your text is really hard to read...

I indicated the error 403 to illustrate that the folder "c:/xampp/htdocs/login/SSL/" exclusively uses SSL encryption

So you have configured "SSLRequireSSL" for the directory "c:/xampp/htdocs/login/SSL/"?

almost as if the .htaccess file is being ignored.

And you have a ".htaccess" in the directory "c:/xampp/htdocs/login/SSL/", with some rewrite rules?

And now, if you access the directory with "http://localhost/login/SSL/", you get an error 401?

[Kunju]

Excatly, I have SSLRequireSSL for my "../login/SSL" folder and the .htaccess file placed in the same folder, but if you try to access the index.php file using http: it brings up Access Forbidden Error 403. When you use https: access is granted; initially a http: request gave an Error 500 & this is what Izzy tried to rectify but now the error is 403. Just to be clear, the .htaccess instructions were saved in notepad and I made sure that the file was saved as ".htaccess". Please alert me on any other info you may require, thanks.

[Wiedmann]

Excatly, I have SSLRequireSSL for my "../login/SSL" folder and the .htaccess file placed in the same folder,

Well, if you have "SSLRequireSSL" for a directory, and you have some other things in a ".htaccess", and you access this dir with "http://", these other things are irrelevant. Because the initial http request is forbidden with "SSLRequireSSL".
--> If you want make a redirect from "http" to "https" in a ".htccess" for a directory, you can't use "SSLRequireSSL" at the same time for this directory.

[Kunju]

Thanks for the info. I had been made to believe that you could do both. So, given a situation in which one might be necessitated to use SSL, which of the two (mod_rewrite or SSLRequireSSL) would be most suitable & why?