Complex URL Redirects

TimeHorse

Not working

sean

TimeHorse perhaps the following will work for you:

RewriteCond %{HTTPS} = on

TimeHorse

Why I do that, it doesn't redirect and I get a 403 (Forbidden). I have a R of 301 BTW, not F. When I try with http with %{HTTPS} on then it just converts to https and gives me the same forbidden.

When I do the pedantic case of:
RewriteCond %{HTTPS} off [OR] RewriteCond %{HTTPS} on

Then the HTTPS redirects properly but the http just goes to the web address of the apache server itself (fordarer.jeffreycjacobs.com).

nick

TimeHorse Hi there,

I'm not seeing any rules in your .htaccess file for the domain forward.jeffreycjacobs.com, so nothing for it will get processed. It looks like you changed the rewrite rules from what they were when you shared them previously. Your current rules only process requests for timehorse.jeffreycjacobs.com and google.jeffreycjacobs.com, so if you want to process a redirect for forward.jeffreycjacobs.com too then add it to the same site record as the other domains and update your .htaccess rules.

TimeHorse

nick The problem is that those are the only rules I'm testing, google.jeffreycjacobs.com and timehorse.jeffreycjacobs.com. I don't expect either of those to redirect to forwarding, yet they do. That's the issue. The way I have things set up, I expect the following:

https://google.jeffreycjacobs.com goes to https google
http://google.jeffreycjacobs.com goes to https google
https://timehorse.jeffreycjacobs.com goes to https timehorse
http://timehorse.jeffreycjacobs.com should not resolve as there is no forwarding rule for it

This is what I'm seeing:

https://google.jeffreycjacobs.com goes to https google (Good)
http://google.jeffreycjacobs.com goes to https google (Good)
https://timehorse.jeffreycjacobs.com gives a 403 Forbidden error and goes nowhere
http://timehorse.jeffreycjacobs.com gives a 403 Forbidden error and goes nowhere

Clearly, the rule for timehorse.jeffreycjacobs.com isn't working. Any advice you can give?

TimeHorse

TimeHorse
RewriteCond %{HTTPS} on RewriteCond %{HTTP_HOST} ^timehorse\.jeffreycjacobs\.com RewriteRule ^(.*)$ https://www.timehorse.com/$1 [R=302,L]
My rule, FYI

sean

TimeHorse it is the HTTPS conditions which seem to be throwing it off.

I'm not sure of the reason for that just yet, but I'll look into it further.

In the meantime, I've checked your site configuration in the Opalstack dashboard and I can see that you have HTTPS redirection enabled for the site. This means that all traffic will be directed to HTTPS by the time the request reaches Apache. Since the requests are guaranteed to be HTTPS at that point there's no need to check that condition in .htaccess so the following should work:

RewriteEngine on

RewriteCond %{HTTP_HOST} ^google\.jeffreycjacobs\.com
RewriteRule ^(.*)$ https://www.google.com/search?q=\%2b"TimeHorse" [R=302,L,NE,QSA]

RewriteCond %{HTTP_HOST} ^timehorse\.jeffreycjacobs\.com
RewriteRule ^(.*)$ https://www.timehorse.com/$1 [R=302,L]

I'll follow up when I've sorted out the problem with the HTTPS conditions.

TimeHorse

Thank you! If I turned off HTTPS then it would allow both HTTP and HTTPS redirects?

Also, I was looking into cloaked forwarding and saw that most people have the forwards go through a proxy via mod_proxy. Do we have a proxy on the Apache service? Is mod_proxy installed and will this work for cloaked forwards?

sean

TimeHorse Thank you! If I turned off HTTPS then it would allow both HTTP and HTTPS redirects?

No, I'm not saying that setting is causing the problem. I'm saying it lets you circumvent the problem.

I'll let you know when I've sorted out the actual problem, ie why HTTPS doesn't seems to work as a rewrite condition. In the meantime I recommend leaving the setting configured (since you are already using it) and use the rewrite example I provided.

TimeHorse Also, I was looking into cloaked forwarding and saw that most people have the forwards go through a proxy via mod_proxy. Do we have a proxy on the Apache service? Is mod_proxy installed and will this work for cloaked forwards?

You can do cloaked forwarding to HTTP URLs, but not to HTTPS URLs. Here's an example for a HTTP URL:

RewriteRule ^(.*)$ http://domain.com/$1 [P,L]

You might be able to do this for HTTPS URLs via a private stack with whatever httpd configuration it requires.

TimeHorse Where is the HTTPS Redirection Option configured?

Go to https://my.opalstack.com/domains/.
Click the Edit icon for your site in the lower section of the page.
Enable the "Encrypt All Traffic?" option.
Click "Update Site" to save the changes.

Again, I recommend leaving it enabled for now.

TimeHorse

Where is the HTTPS Redirection Option configured?

TimeHorse

If I leave it on, does that mean I can’t use cloaked forwarding? I will be using this for dozens of sites in the end, these are just proof of concept which I’m working on now.

sean

TimeHorse the "Encrypt All Traffic" setting is unrelated to cloaked forwarding via mod_proxy.

You cannot use cloaked forwarding via mod_proxy on our platform if the destination website (ie the other site that you are proxying to) is using HTTPS.

If the destination website is not using HTTPS, then you can use cloaked forwarding via mod_proxy.

TimeHorse

Don’t worry, I checked and my cloaks are only going to http

sean

@TimeHorse here are the correct rewrites for our platform:

RewriteEngine on

RewriteCond %{HTTP:X-Forwarded-SSL} on
RewriteCond %{HTTP_HOST} ^google\.jeffreycjacobs\.com
RewriteRule ^(.*)$ https://www.google.com/search?q=\%2b"TimeHorse" [R=302,L,NE,QSA]

RewriteCond %{HTTP:X-Forwarded-SSL} on
RewriteCond %{HTTP_HOST} ^timehorse\.jeffreycjacobs\.com
RewriteRule ^(.*)$ https://www.timehorse.com/$1 [R=302,L]

It's done this way because on our platform the SSL happens in Nginx upstream of Apache.

TimeHorse

Thank you but that's not quite what I was looking for. I want a test that allows both http and https originating via protocol traffic to google but only https traffic to go to timehorse. That is, http://timehorse.jeffreycjacobs.com/ should return an error as it's requesting an unsecured page and this rewrite rule only handles SSL traffic. The point is, I want HTTP requests to go to one page, and HTTPS to go to another. Is that possible?

Jeffrey

sean

TimeHorse I want HTTP requests to go to one page, and HTTPS to go to another. Is that possible?

Yes, the conditions to use are:

# HTTP
RewriteCond %{HTTP:X-Forwarded-SSL} !on

# HTTPS
RewriteCond %{HTTP:X-Forwarded-SSL} on

TimeHorse

I think you're missing my point. I have only on for timehorse.jeffreycjacobs.com, so that https should redirect, but http should not. However, both are currently redirecting. I add the on state but http is still allowed

sean

TimeHorse you still have the "Encrypt All Traffic?" option enabled for your site so the request is always HTTPS by the time it reaches Apache. This means it's matching "RewriteCond %{HTTP:X-Forwarded-SSL} on" and being forwarded.

If you want HTTP URLs to work then you'll need to disable the "Encrypt All Traffic?" option. That should be OK now since we've sorted out the earlier problem with the HTTPS rewrite condition.

TimeHorse

I just disabled the Encrypt all Traffic and htp://timehorse.jeffreycjacobs.com/ still went to https://www.timehorse.com/ despite the forward saying X-Forwarded-SSL on implying that !on is not allowed, and neither is off.

sean

TimeHorse I think you might have the redirect cached in your browser. When I check http://timehorse.jeffreycjacobs.com/ with curl there's no redirect:

$ curl -vL http://timehorse.jeffreycjacobs.com/
*   Trying 207.244.121.250:80...
* Connected to timehorse.jeffreycjacobs.com (207.244.121.250) port 80
> GET / HTTP/1.1
> Host: timehorse.jeffreycjacobs.com
> User-Agent: curl/8.4.0
> Accept: */*
>
< HTTP/1.1 403 Forbidden
< Server: nginx
< Date: Sat, 13 Jan 2024 22:02:19 GMT
< Content-Type: text/html; charset=iso-8859-1
< Content-Length: 280
< Connection: keep-alive
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /
on this server.</p>
<hr>
<address>Apache Server at timehorse.jeffreycjacobs.com Port 80</address>
</body></html>
* Connection #0 to host timehorse.jeffreycjacobs.com left intact

The 403 is the expected result because directory indexes are disabled by default and there's no index.html in your app directory.

« Previous Page Next Page »