htaccess-重定向到https不起作用

Question

Per: https://exp-resso.com/blog/post/2011/08/securing-your-expressionengine-website-with-https

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond $1 ^(member|account|checkout|system) [NC]
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] 

This tells your server “If HTTPS is off, and the request starts with member OR account OR checkout OR system (not case sensitive), redirect to https://current-domain/current-page ”. It's a nice simple method of locking down entire subfolders / template groups.

I've added this to my htaccess file like this:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{HTTPS} off
    RewriteCond $1 ^(sign-in|sign-up) [NC]
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] 
</IfModule>

However, when I go to my http://mydomain.com/sign-in , the URL doesn't change to https://mydomain.com/sign-in . Any idea what's wrong?

EDIT 1:

My htaccess also has the following (to remove "www") and I wonder if having both might be causing the problem?

RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ http://%1%{REQUEST_URI} [R=301,L]

EDIT 2:

Process of elimination, it turns out this is causing the problem:

<IfModule mod_rewrite.c>
        RewriteEngine On

        # Removes index.php from ExpressionEngine URLs
        RewriteCond $1 !\.(gif|jpe?g|png)$ [NC]
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteRule ^(.*)$ /index.php/$1 [L]
</IfModule>

When I comment out the RewriteRule, the https:// is forces. What's causing the conflict?

Answer 1

Try to put (sign-in|sign-up) condition inside RewriteRule:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(sign-in|sign-up)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,NC,R=301] 

Answer 2

What about this? (If port == 80 then redirect )

RewriteEngine on
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} member [OR]
RewriteCond %{REQUEST_URI} account [OR]
RewriteCond %{REQUEST_URI} checkout [OR]
RewriteCond %{REQUEST_URI} system
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

Answer 3

First make sure that rewrite works on your server and that the htaccess is read (eg by issuing a redirect on every URL).

Then use RewriteCond %{REQUEST_URI} ^/(sign-in|sign-up) instead of RewriteCond $1 ^(sign-in|sign-up) [NC]

It works and is easier to read too

So you htaccess should look like this

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{REQUEST_URI} ^/(sign-in|sign-up) [NC]
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]