LiveCode Forums

Using apache on Linux (and of course, livecode server ), what is the proper way to disallow http and force all to https? Is it simply utilizing the redirect functionality? .....or is there a more proper way in which to disallow requests via http?

TIA

I would just use .htaccess rewrite to force the https.

Thank you Pyrros,

If I could add one more question.....can this methodology be used to:

1) redirect all http requests to https EXCEPT...

2) if I have a directory in my documentroot called, say, "sslonly", can I make it so that any http requests to assets inside sslonly will NOT get rewritten and simply denied?

I ask because I do indeed want to globally force all http to https, but for some directories, I would like to simply deny http requests and require https be used from the gitgo....(I.E. for requests to assets inside sslonly, if they come in via http I don't want to rewrite and redirect to https....I want to deny them)

Thanks again Pyrros!

Paul

Hi Paul

You should be able to do that.

I'm not an htaccess expert but I guessing something like this would work:

htaccess directory in the site root - specify which urls must redirect to ssl e.g:

RewriteCond %{HTTPS} != on
RewriteRule ^(system|dashboard) {http-domain}%{REQUEST_URI} [NC,R=301]

In the sslonly directory have another htaccess file to restrict access to only ssl:

RewriteEngine On
RewriteCond %{SERVER_PORT} !443
RewriteRule (.*) {warning-page} [R]

I can't post urls so,
{http-domain} would be your domain's https url
{warning-page} would be page telling the user the request was denied

Hope this helps.
Simon