仅在具有.htaccess的特定页面上使用HTTPS

Question

I have a URL such as http://www.domain.com/index.php?p=register . I want to redirect that to use HTTPS (SSL) with .htaccess, but only on this, and a couple of other pages (the login page, etc), but not the entire site. The URLs don't point to directories, but are used to dynamically include different files.

Can someone give me a pointer or an example of how to get a single page redirect to HTTPS please?

Thanks.

Answer 1

Not htaccess, but another way could be to use PHP to redirect:

<?php

$redirectlist = array('register','login','myaccount');

if (in_array($_GET['p'], $redirectlist) && strtolower($_SERVER['HTTPS']) != 'on') {
    exit(header("location: https://{$_SERVER['SERVER_NAME']}{$_SERVER['REQUEST_URI']}"));
}

?>

The only reason I mention this is that, in some cases, this may be easier to maintain than a separate htaccess. You would need to put this in place in your PHP content before any text was outputted (see header() ).

Answer 2

something like this should work:

RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteCond %{QUERY_STRING} (^|&)p=(register|login|or|other|protected|page)($|&)
RewriteRule (.*) https://www.domain.com/index.php [R=301,QSA,L]

Some explanation:

1. Check if server port is different from 443 (standard for secure connections), to ensure we are going to redirect only non-secured connections
2. The query string (everything after ?) have to match pattern: include p variable with one value from pipe separated list
3. Redirect everything to secure domain, sending 301 response status, appending all query string and marking is as last rule, so any rules below this will not be parsed (since this is redirect, we don't want to take any other actions)

Answer 3

If you have option to follow the php method, I would recommend to follow that or with any other dynamic languages. You must avoid using htaccess since links to images, js and other contact on that page will be forced to be nonSSL and modern browsers would show a non-compliance sign which might look a whitewash over your SSL cost.