web:webprotect:force_https
Differences
This shows you the differences between two versions of the page.
| web:webprotect:force_https [2017/12/20 19:04] – external edit 127.0.0.1 | web:webprotect:force_https [2017/12/20 22:53] (current) – removed jas | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Forcing Page Access Over HTTPS ====== | ||
| - | |||
| - | If your web page is requesting a password, it is best to send the password over an encrypted channel. | ||
| - | |||
| - | Before your authentication block, add this code to redirect http://URL to https:// | ||
| - | |||
| - | < | ||
| - | RewriteEngine On | ||
| - | RewriteCond %{HTTPS} off | ||
| - | RewriteRule ^/?(.*) https:// | ||
| - | </ | ||
| - | |||
| - | Surrounding your authentication block, add this condition which forces authentication to only occur when your page is served over https: | ||
| - | |||
| - | < | ||
| - | <If " | ||
| - | <Your authentication block> | ||
| - | </If> | ||
| - | </ | ||
| - | |||
| - | That's all you need to do! Putting it together, here's an example: | ||
| - | |||
| - | < | ||
| - | RewriteEngine On | ||
| - | RewriteCond %{HTTPS} off | ||
| - | RewriteRule ^/?(.*) https:// | ||
| - | |||
| - | <If " | ||
| - | AuthType Basic | ||
| - | AuthName "My Page" | ||
| - | AuthBasicProvider pam | ||
| - | require valid-user | ||
| - | </If> | ||
| - | </ | ||
| - | |||
| - | NOTE: The Passport York module forces HTTPS access, so you don't need to use this trick when authenticating with Passport York. | ||
| - | |||
web/webprotect/force_https.1513814657.txt.gz · Last modified: 2017/12/20 22:53 (external edit)