0

In an Apache 2 vhost I have the following configuration (in my case, in .htaccess of the document root (which is for simplicity the same for http:80 and https:443)

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

in order to redirect any http-connections to https Moreover,

ErrorDocument 500 /error.php
ErrorDocument 404 /error.php
ErrorDocument 403 /error.php
ErrorDocument 402 /error.php
ErrorDocument 401 /error.php

to produce custom error messages. The third ingredient is a protected subfolder with authentication required (per .htaccess in that folder):

AuthType Basic
AuthName "Test"
AuthUserFile  /some/path/to/passwords
Require user joe

Everything works fine except when someone tries to retrieve http://example.com/protectedfolder In fact, what happens is that the client gets a 302 Found reply with redirection to https://example.com/error.php

On the other hand,

  • https://example.com/protectedfolder leads to a custom (i.e., produced by error.php) 401 as expected.
  • http://example.com/publicfolder leads to 302 redirect to https://example.com/publicfolder, then a 301 permanent redirect to https://example.com/publicfolder/, and finally (as DirectoryIndex is disabled) a customized 403 error. As expected.
  • Also, http://example.com/nonexistent causes a 302 to https://example.com/nonexistent and then a customized 404, also as expected.
  • If I disable the ErrorDocument 401 configuration, a query for http://example.com/protectedfolder causes 401 immediately, i.e., without redirection to https.

There is no specific entry in Apache error.log, but it seems that the problem occurs because the Auth requirement is evaluated before the Rewrite, thus invokes the ErrorDocument and that is wrongly still http??

What do I need to change in order to have the desired effect, i.e., that http://example.com/protectedfolder causes a redirect to https://example.com/protectedfolder and only that redirected URL causes a (customized) 401?

Hagen von Eitzen
  • 824
  • 3
  • 17
  • 43

1 Answers1

1

Since you do unconditional redirect from http to https (a bad idea if you want everyone to be able to access the public information on your web-site, BTW), then you should just make separate host entries for :80 and :443, and point the :80 entry towards something like an empty folder — then you wouldn't have mod_auth competing with mod_rewrite.

cnst
  • 13,848
  • 9
  • 54
  • 76