Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HTTP -> HTTPS #9

Open
curtchan opened this issue Jul 5, 2019 · 6 comments
Open

HTTP -> HTTPS #9

curtchan opened this issue Jul 5, 2019 · 6 comments

Comments

@curtchan
Copy link

curtchan commented Jul 5, 2019

should provide http -> https rewrite cond if these mismatch

input:
http://example.org/example-path/ https://example.org/example-path/

current output:
RewriteRule ^example\-path/$ /example\-path/? [L,R=301]

expected output:

RewriteCond %{HTTPS} !=on
RewriteRule ^example\-path/$ https://example.org/example\-path/? [L,R=301]

Maybe it should be as opt-in feature for the RewriteCond part, but the expected output RewriteRule definitely requires fix

@donatj
Copy link
Owner

donatj commented Jul 10, 2019

I've put a lot of thought into this before.

I've gotten a small handful of requests for this before, but I'm on the fence.

I can absolutely understand seeing this as a deficiency of the tool, but I feel like it encourages bad use cases where inexperienced people think they need to redirect every url when they should instead be using a wildcard.

If you have an SSL set up for your domain in this day and age, you basically always should just be redirecting HTTP wildcard to HTTPS

Something like:

RewriteCond %{HTTPS} !=on
RewriteRule (.*) https://www.example.com/$1

@donatj
Copy link
Owner

donatj commented Jul 10, 2019

I'm actually pondering instead just adding a warning to the output if the protocols don't match. I think that would be a decent compromise.

@donatj
Copy link
Owner

donatj commented Jul 10, 2019

I've created a small fix #11 to just that - error on scheme change. I think I'm going to sleep on it though.

@curtchan
Copy link
Author

Yes, and no. Indeed it may have to be idiot-proof and do wildcard by default, but an option for scheme rule generated would be really good as well. You see in SEO we often see old indexed urls, that don't have 1:1 https representation, instead we redirect it to different URL, BUT the earlier used path may be used in future, so we don't want it to be wildcard redirected no matter the scheme used.

@curtchan
Copy link
Author

curtchan commented Aug 5, 2019

Second example, hosts option should be available always:
Think about multisite blog, we redirect one url to another, but only for single domain, other domains attached to same blog (use all same htaccess file) shouldn't be affected by that redirect.

@ramonfincken
Copy link

Keep in mind that

RewriteCond %{HTTPS} !=on

does not catch all, you also need

RewriteCond %{HTTP:X-Forwarded-Proto} !https

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants