HTTP/HTTPS, without index.php, using htaccess, plus XHR

http://ellislab.com/forums/viewthread/86113/

Removing index.php and forcing HTTP/HTTPS I have read many posts about people trying to force HTTPS for some views and returning to HTTP for others. I struggled with this for a while too but I think this solution is pretty solid. First of all, having your base_url automatically adjust between http and https makes everything much easier. This way all your base_url() and site_url() calls have the proper protocol. $config['base_url'] = "http".((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == "on") ? "s" : "")."://".$_SERVER['HTTP_HOST'].str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);  Starting with the usual htaccess file: <IfModule mod_rewrite.c>     RewriteEngine on     Options +FollowSymLinks     RewriteBase /          RewriteCond %{REQUEST_FILENAME} !-f     RewriteCond %{REQUEST_FILENAME} !-d     RewriteRule ^(.*)$ index.php/$1 </IfModule> <IfModule !mod_rewrite.c>     ErrorDocument 404 /index.php </IfModule>  You can then check whether HTTPS is on or not with: RewriteCond %{HTTPS} off RewriteCond %{HTTPS} on  For example, to force HTTPS on all pages you could use the following: RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301]  To force HTTPS on some pages: RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} (auth|register|secure) RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301]  To return back to HTTP: RewriteCond %{HTTPS} on RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301]  To return back to HTTP on all other pages, you need to add exceptions for the pages that are secure: RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} (auth|register|secure) RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301] RewriteCond %{HTTPS} on RewriteCond %{REQUEST_URI} !(auth|register|secure) RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301]  To avoid a partially encrypted page, you need to add exceptions for any other URIs you might use such as your images or scripts folder. I like to place everything in a folder called ‘static’ (‘static/images’, ‘static/js’, etc) so I only add one exception for that. RewriteCond %{REQUEST_URI} !(static|auth|register|secure)  The finished product: <IfModule mod_rewrite.c>     RewriteEngine on     Options +FollowSymLinks     RewriteBase /          RewriteCond %{REQUEST_FILENAME} !-f     RewriteCond %{REQUEST_FILENAME} !-d     RewriteRule ^(.*)$ index.php/$1     RewriteCond %{HTTPS} off     RewriteCond %{REQUEST_URI} (auth|register|secure)     RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301]     RewriteCond %{HTTPS} on     RewriteCond %{REQUEST_URI} !(static|auth|register|secure)     RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301] </IfModule> <IfModule !mod_rewrite.c>     ErrorDocument 404 /index.php </IfModule>  HTTPS and XmlHttpRequests (Ajax) Not only do XHR calls throw security errors when you try to load content between domains but also between HTTP and HTTPS. Secondly, the headers passed by apache allow browsers to automatically redirect but the XmlHttpRequest object does not. To solve this you would have to add an exception for any URI that you planned on accessing from one protocol to another. Example: RewriteCond %{REQUEST_URI} !(static|auth|register|secure|categories/get_list|products/get_types) <?=site_url('categories/get_list');?>  I quickly found out that this became tedious and confusing when I had a lot of requests in a secure environment. Routes to the rescue! By adding the following to your routes file: $route['xhr/(:any)'] = '$1';  And adding ‘xhr’ to your list of exceptions; you can now call any URI within your application without changing protocols while still allowing the browser to view that controller using another protocol. RewriteCond %{REQUEST_URI} !(static|xhr|auth|register|secure) <?=site_url('xhr/categories/get_list');?>  I hope this has been helpful! Phil

Dylan Posted: 09 December 2008 08:08 PM   [ Ignore ]   [ # 1 ]   [ Rating: 0 ] Joined: 2008-01-22 2 posts Might be a bit late, but this is quite informative. Good post. =]

vlad_ci Posted: 10 December 2008 02:45 AM   [ Ignore ]   [ # 2 ]   [ Rating: 0 ] Joined: 2008-07-16 40 posts thank you for bumping this up—I have not seen this post and it is exactly what I needed

terminate Posted: 18 June 2009 05:16 AM   [ Ignore ]   [ # 3 ]   [ Rating: 0 ] Joined: 2007-10-27 6 posts Phil_B’s .htaccess is great and I’m an active user of it! I would just drop my two cents. If you follow the rules straight all your static content will be served non SSL which is actually good for performance but will drop a Firefox alert (not all content is encrypted) and you will not get the blue/green bar. Just a small change to make the static content, under encrypted pages, be encrypted served. Also added the [L] (last) modifier to make the server stop processing after one of the bottom two requests (should make it micro, mini, faster). RewriteEngine on Options +FollowSymLinks RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ index.php/$1 RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} (auth|register|secure|payment) RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L] RewriteCond %{HTTPS} on RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} !(static|auth|register|secure|payment) RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]  Thanks for your code Phil_B! Frankie