Apache mod_rewrite rules to disable https/ssl except for some pages

Question

I have a website that trigger HTTPS when brosing some pages and I want to revert back to HTTP when not browsing those pages, and this is my htaccess:

<IfModule mod_rewrite.c>

  RewriteEngine on
  #RewriteBase /myproject/

  # toggle www prefix
  RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
  RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

  # redirect favicon requests to the correct favicon.ico
  RewriteCond %{REQUEST_URI} !^/favicon\.ico [NC]
  RewriteCond %{THE_REQUEST} favicon\.(ico|png|gif|jpe?g) [NC]
  RewriteRule (.*) http://mysite/favicon.ico [R=301,L]

  # hide index.php from root
  RewriteCond %{THE_REQUEST} ^[A-Z]{3,}\s(.*)/index\.php [NC]
  RewriteRule ^ /%1 [R=301,L]

  # disable HTTPS when not needed
  RewriteCond %{HTTPS} on
  #RewriteCond %{HTTP_REFERER} !^(https)(.*)$
  RewriteCond %{REQUEST_URI} !^(.*)/(exception|xyz|pqr)(.*)$ [NC]
  RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

  # if a directory or a file exists, use it directly
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d

  # otherwise forward it to index.php
  RewriteRule . index.php [L,QSA]
  #RewriteRule ^(.*)\?*$ index.php/$1 [L,QSA]

</IfModule>

If I call https://host/url the redirect works fine landing to http://host/url, but if I call https://host/exception instead of leaving it as is I'll be redirected to http://host/index.php

What's wrong? Thanks

UPDATE with solution, hoping it will be useful to someone

<IfModule mod_rewrite.c>

  RewriteEngine on
  #RewriteBase /yourbase

  # hide index.php from root
  RewriteCond %{THE_REQUEST} ^[A-Z]{3,}\s(.*)/index\.php [NC]
  RewriteRule ^ /%1 [R=301,L]

  # pass-through so when the rules loop (https), the redirect to index won't get applied
  RewriteRule index.php$ - [L]

  # toggle www prefix
  RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
  RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

  # redirect favicon requests to the correct favicon.ico
  RewriteCond %{REQUEST_URI} !^/favicon\.ico [NC]
  RewriteCond %{THE_REQUEST} favicon\.(ico|png|gif|jpe?g) [NC]
  RewriteRule (.*) http://liberos.it/favicon.ico [R=301,L]

  # disable HTTPS when not needed (but don't rewrite direct files requests)
  RewriteCond %{HTTPS} on
  #RewriteCond %{HTTP_REFERER} !^(https)(.*)$
  RewriteCond %{REQUEST_URI} !^(.*)/(yourpath|another/path)(.*)$ [NC]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d [OR]
  RewriteCond %{REQUEST_URI} .
  RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

  # if a directory or a file exists use it directly, otherwise forward it to index.php
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . index.php
  #RewriteRule ^(.*)\?*$ index.php/$1 [L,QSA]

</IfModule>

possible duplicate of [.htaccess 301 redirect for all https to http EXCEPT ONE PAGE](http://stackoverflow.com/questions/2079015/htaccess-301-redirect-for-all-https-to-http-except-one-page) — jww, Jul 25 '14 at 13:01

score 0 · Accepted Answer · answered Oct 19 '12 at 22:52

0

Since you are routing everything through index.php, you need to create a pass-through so when the rules loop, the redirect won't get applied. Try adding this rule at the very top of your list of rules:

RewriteRule index.php$ - [L]

answered Oct 19 '12 at 22:52

Jon Lin

142,182
29
220
220

Thanks, this do the job! But now I have to solve the next problem: the page doesn't have full https content so the browser is displaying a warning for not safe content. I can solve this by enabling this commented line #RewriteCond %{HTTP_REFERER} !^(https)(.*)$ but it's not good to use referer because when I click a https link that should use http it will not match the rule and will stay https until I click on another link, then will switch to http – manuel-84 Oct 20 '12 at 01:01
Note that I also had to put before your suggested rule the part to hide index.php from root, otherwise `https://host/index.php` will be reachable and I don't want – manuel-84 Oct 20 '12 at 01:16
I solved also this problem and I'm posting my final htaccess hoping will help someone – manuel-84 Oct 21 '12 at 14:11
Jon, Please can you look at this question: http://stackoverflow.com/questions/25803626/how-to-route-a-particular-url-to-both-http-and-https-and-others-to-https-in-apac – Uchenna Nwanyanwu Sep 12 '14 at 08:20

score 0 · Answer 2 · answered Nov 10 '12 at 00:38

<IfModule mod_rewrite.c>

  RewriteEngine on
  #RewriteBase /yourbase

  # hide index.php from root
  RewriteCond %{THE_REQUEST} ^[A-Z]{3,}\s(.*)/index\.php [NC]
  RewriteRule ^ /%1 [R=301,L]

  # pass-through so when the rules loop (https), the redirect to index won't get applied
  RewriteRule index.php$ - [L]

  # toggle www prefix
  RewriteCond %{HTTP_HOST} ^www\.(.*)$ [NC]
  RewriteRule ^(.*)$ http://%1/$1 [R=301,L]

  # redirect favicon requests to the correct favicon.ico
  RewriteCond %{REQUEST_URI} !^/favicon\.ico [NC]
  RewriteCond %{THE_REQUEST} favicon\.(ico|png|gif|jpe?g) [NC]
  RewriteRule (.*) http://liberos.it/favicon.ico [R=301,L]

  # disable HTTPS when not needed (but don't rewrite direct files requests)
  RewriteCond %{HTTPS} on
  #RewriteCond %{HTTP_REFERER} !^(https)(.*)$
  RewriteCond %{REQUEST_URI} !^(.*)/(yourpath|another/path)(.*)$ [NC]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d [OR]
  RewriteCond %{REQUEST_URI} .
  RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

  # if a directory or a file exists use it directly, otherwise forward it to index.php
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteRule . index.php
  #RewriteRule ^(.*)\?*$ index.php/$1 [L,QSA]

</IfModule>

Apache mod_rewrite rules to disable https/ssl except for some pages

2 Answers2