使用.htaccess和mod_rewrite强制使用SSL/https

Question

使用.htaccess和mod_rewrite强制使用SSL/https

如何使用.htaccess和PHP中特定的mod_rewrite页面强制使用SSL/https。

Answer 1

我找到了一个mod_rewrite对代理服务器和未代理服务器都有效的解决方案。如果你用CloudFlare，AWS弹性负载平衡，Heroku，OpenShift或任何其他云/PaaS解决方案重定向回路对于正常的HTTPS重定向，请尝试下面的片段。RewriteEngine On# If we receive a forwarded http request from a proxy...RewriteCond %{HTTP:X-Forwarded-Proto} =http [OR] # ...or just a plain old http request directly from the clientRewriteCond %{HTTP:X-Forwarded-Proto} =""RewriteCond %{HTTPS} !=on # Redirect to https versionRewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Answer 2

PHP解决方案直接借用Gordon非常全面的回答，我注意到您的问题在强制HTTPS/SSL连接时提到了特定于页面的问题。function&nbsp;forceHTTPS(){ &nbsp;&nbsp;$httpsURL&nbsp;=&nbsp;'https://'.$_SERVER['HTTP_HOST'].$_SERVER['REQUEST_URI']; &nbsp;&nbsp;if(&nbsp;count(&nbsp;$_POST&nbsp;)>0&nbsp;) &nbsp;&nbsp;&nbsp;&nbsp;die(&nbsp;'Page&nbsp;should&nbsp;be&nbsp;accessed&nbsp;with&nbsp;HTTPS,&nbsp;but&nbsp;a&nbsp;POST&nbsp;Submission&nbsp;has&nbsp;been&nbsp;sent&nbsp;here.&nbsp;Adjust&nbsp;the&nbsp;form&nbsp;to&nbsp;point&nbsp;to&nbsp;'.$httpsURL&nbsp;); &nbsp;&nbsp;if(&nbsp;!isset(&nbsp;$_SERVER['HTTPS']&nbsp;)&nbsp;||&nbsp;$_SERVER['HTTPS']!=='on'&nbsp;){ &nbsp;&nbsp;&nbsp;&nbsp;if(&nbsp;!headers_sent()&nbsp;){ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;header(&nbsp;"Status:&nbsp;301&nbsp;Moved&nbsp;Permanently"&nbsp;); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;header(&nbsp;"Location:&nbsp;$httpsURL"&nbsp;); &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exit(); &nbsp;&nbsp;&nbsp;&nbsp;}else{ &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;die(&nbsp;'<script&nbsp;type="javascript">document.location.href="'.$httpsURL.'";</script>'&nbsp;); &nbsp;&nbsp;&nbsp;&nbsp;} &nbsp;&nbsp;}}然后，当您想要通过PHP强制连接这些页面的顶部时，您可以require()包含此(和任何其他)自定义函数的集中式文件，然后简单地运行forceHTTPS()功能。HTACCESS/MOD重写解我没有亲自实现这种解决方案(我倾向于使用PHP解决方案，就像上面的解决方案一样，因为它的简单性)，但至少下面是一个好的开始。RewriteEngine&nbsp;on#&nbsp;Check&nbsp;for&nbsp;POST&nbsp;SubmissionRewriteCond&nbsp;%{REQUEST_METHOD}&nbsp;!^POST$#&nbsp;Forcing&nbsp;HTTPSRewriteCond&nbsp;%{HTTPS}&nbsp;!=on&nbsp;[OR]RewriteCond&nbsp; %{SERVER_PORT}&nbsp;80#&nbsp;Pages&nbsp;to&nbsp;ApplyRewriteCond&nbsp;%{REQUEST_URI}&nbsp;^something_secure&nbsp;[OR]RewriteCond&nbsp;%{REQUEST_URI}&nbsp;^something_else_secureRewriteRule &nbsp;.*&nbsp;https://%{SERVER_NAME}%{REQUEST_URI}&nbsp;[R=301,L]#&nbsp;Forcing&nbsp;HTTPRewriteCond&nbsp;%{HTTPS}&nbsp;=on&nbsp;[OR]RewriteCond&nbsp;%{SERVER_PORT}&nbsp;443 &nbsp;#&nbsp;Pages&nbsp;to&nbsp;ApplyRewriteCond&nbsp;%{REQUEST_URI}&nbsp;^something_public&nbsp;[OR]RewriteCond&nbsp;%{REQUEST_URI}&nbsp;^something_else_publicRewriteRule&nbsp;. &nbsp;*&nbsp;http://%{SERVER_NAME}%{REQUEST_URI}&nbsp;[R=301,L]