Force HTTPS with mod_rewrite, including proxied SSL

apache-2.2mod-rewrite

I've got a server getting some traffic from an SSL terminating load balancer- in which case it comes in as HTTP over port 80 with a http_x_forwarded_proto = "https"

I want a mod_rewrite rule that only allows direct HTTPS traffic or forwarded HTTPS traffic.

I have this so far:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:http_x_forwarded_proto} != https
RewriteCond %{HTTP:http_x_forwarded_proto} != HTTPS
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

but I'm getting

RewriteCond: bad flag delimiters

error.

What do I need to correct to get this working, and is this the best approach?

Best Answer

The problem was the whitespace after the "!=":

Working version:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

tricky...

Related Topic