apache .htaccess 需要特定 URL 的 SSL

.htaccess require SSL for a particular URL

提问by Timmy_

I want to force Apache to use HTTPS for a particular URL in the following form:

我想强制 Apache 使用以下形式的特定 URL 的 HTTPS：

https://www.example.com/signup/*

so

所以

if someone goes to any of the following example URLs directly, Apache will forward the URL over to the HTTPS equivalent site.

如果有人直接访问以下任何示例 URL，Apache 会将 URL 转发到 HTTPS 等效站点。

e.g.

例如

http://www.example.com/signup  -->  https://www.example.com/signup
http://www.example.com/signup/basic+plan  -->  https://www.example.com/signup/basic+plan
http://www.example.com/signup/premium  -->  https://www.example.com/signup/premium 

Anyone know how?

有谁知道怎么做？

Thanks in advance

提前致谢

回答by Timmy_

Thank Murat,

感谢穆拉特，

Yours almost worked but figured out how to get it to exactly work.

你的几乎工作，但想出了如何让它完全工作。

The following is what works:

以下是有效的：

RewriteCond %{SERVER_PORT} 80 
RewriteCond %{REQUEST_URI} ^/somefolder/?
RewriteRule ^(.*)$ https://www.domain.com/ [R,L]

Notice that I didn't include somefolder in the www.domain.com rewriterule

请注意，我没有在 www.domain.com 重写器中包含 somefolder

回答by Murat Ayfer

I think this was what i used:

我认为这是我使用的：

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80 
RewriteCond %{REQUEST_URI} ^/somefolder/?
RewriteRule ^(.*)$ https://www.domain.com/somefolder/ [R,L]

(from here)

（从这里）

回答by Greg Hewgill

You can use the Redirectdirective:

您可以使用重定向指令：

Redirect 301 /signup https://www.example.com/signup

This will automatically preserve anything following /signup in the URL. Be sure to configure this directive only on your non-SSL site, or it might get into a recursive loop!

这将自动保留 URL 中 /signup 之后的任何内容。请确保仅在您的非 SSL 站点上配置此指令，否则它可能会进入递归循环！

回答by hayalci

You should take a look at mod_rewritedocumentation

你应该看看mod_rewrite文档

回答by hayalci

I used the following to require the checkout section of a website to require SSL:

我使用以下内容要求网站的结帐部分需要 SSL：

<Directory "/var/www/html">
        RewriteEngine on
        Options +FollowSymLinks
        Order allow,deny
        Allow from all
        RewriteCond %{SERVER_PORT} !^443$
        RewriteRule \.(gif|jpg|jpeg|jpe|png|css|js)$ - [S=1]
        RewriteRule ^checkout(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
</Directory>

So for example, hitting http://www.example.com/checkoutredirects to https://www.example.com/checkout

例如，点击http://www.example.com/checkout重定向到https://www.example.com/checkout

The rule will skip file extensions that are typically included within a page so that you don't get mixed content warnings. You should add to this list as necessary.

该规则将跳过通常包含在页面中的文件扩展名，这样您就不会收到混合内容警告。您应该根据需要添加到此列表中。

If you want multiple pages change the RewriteRule to something like:

如果您想要多个页面，请将 RewriteRule 更改为：

RewriteRule ^(checkout|login)(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

Of course, the directory should match the actual path on your server. This page may also help with some more information for your specific needs: http://www.whoopis.com/howtos/apache-rewrite.html

当然，该目录应该与您服务器上的实际路径相匹配。此页面还可以帮助您提供更多信息以满足您的特定需求：http: //www.whoopis.com/howtos/apache-rewrite.html

I'm using this on a website that runs Plesk 8.6 but that shouldn't matter. This is in my vhost.conf file which is like putting it in your httpd.conf file. I'm not sure if you'd need to adjust anything to use it in a .htaccess file but I doubt it. If adding to a conf file don't forget to restart apache to reload the configuration.

我在运行 Plesk 8.6 的网站上使用它，但这无关紧要。这是在我的 vhost.conf 文件中，就像把它放在你的 httpd.conf 文件中一样。我不确定您是否需要调整任何内容才能在 .htaccess 文件中使用它，但我对此表示怀疑。如果添加到 conf 文件，请不要忘记重新启动 apache 以重新加载配置。

If you are like me and want to use SSL only on particular pages then you also want a rewrite rule that sends you back to regular http for the rest. You can use the following for the reverse effect:

如果您像我一样并且只想在特定页面上使用 SSL，那么您还需要一个重写规则，将您发送回常规 http 以供其他页面使用。您可以使用以下方法来实现相反的效果：

RewriteCond %{SERVER_PORT} ^443$
RewriteRule \.(gif|jpg|jpeg|jpe|png|css|js)$ - [S=1]
RewriteRule !^(checkout|login)(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [L,R]

If you are using Plesk like I am keep in mind that all non-SSL traffic uses the vhost.conf file but all SSL traffic uses the vhost_ssl.conf file. That means your first rewrite rule to require SSL would go in the vhost.conf file but the second rule to force back to non-SSL will have to go in the vhost_ssl file. If you are using httpd.conf or .htaccess I think you can put them both in the same place.

如果您像我一样使用 Plesk，请记住所有非 SSL 流量都使用 vhost.conf 文件，但所有 SSL 流量都使用 vhost_ssl.conf 文件。这意味着您要求 SSL 的第一个重写规则将放在 vhost.conf 文件中，但第二个强制返回非 SSL 的规则必须放在 vhost_ssl 文件中。如果您使用的是 httpd.conf 或 .htaccess，我认为您可以将它们放在同一个地方。

I've also posted this tutorial on my blog: Apache rewrite rules to force secure/non-secure pages.

我还在我的博客上发布了本教程：Apache rewrite rules to force secure/non-secure pages。

回答by RobbySherwood

.htaccess files are normally placed in a scope with Options -FollowSymLinks, which blocks Rewrite rules. This is often a security rule.

.htaccess 文件通常放置在具有选项 -FollowSymLinks 的范围内，这会阻止重写规则。这通常是一个安全规则。

So a more trivial thing is often needed like this one:

所以经常需要这样一件更琐碎的事情：

<If "%{HTTPS} != 'on'">
  Redirect 301 /your/path https://www.example.com/your/path
</If>

This is a small enhancement to the answer of Greg Hewgill.

这是对 Greg Hewgill 答案的一个小改进。

回答by Bill B

You can do this with mod_rewrite -

你可以用 mod_rewrite 做到这一点 -

RewriteCond %{SERVER_PORT} !^443$

RewriteCond %{SERVER_PORT} !^443$

RewriteRule ^/signup https://example.com/signup

重写规则 ^/signup https://example.com/signup

RewriteRule ^/signup/(.*)$ https://example.com/signup/$1

重写规则 ^/signup/(.*)$ https://example.com/signup/$1

Should work, though I haven't tested it.

应该可以用，虽然我还没有测试过。

-- edit --

- 编辑 -

Correction, I just tried this on one of my servers, and it works fine for me. You may want to doublecheck your mod_rewrite configuration. Also, if you're using .htaccess, you'll want to make sure overrides are allowed for that directory.

更正，我只是在我的一台服务器上尝试过这个，它对我来说很好用。您可能需要仔细检查您的 mod_rewrite 配置。此外，如果您使用 .htaccess，您需要确保该目录允许覆盖。

As a side note, this assumes your SSL traffic is coming over port 443. If it isn't, you'll need to adjust the rewrite condition accordingly.

作为旁注，这假设您的 SSL 流量来自端口 443。如果不是，您需要相应地调整重写条件。