Subject: RE: Respond only to SSL requests?

From: David Marshall <[email-masked]>
Date: Fri, 5 Apr 2002 07:12:12 -0800

I use an unsecured Virtual Host on my HTTP side and redirect all requests to
HTTPS using a "Redirect seeother".

-----Original Message-----
From: CJ Kucera [mailto:[email-masked]]
Sent: Friday, April 05, 2002 7:01 AM
To: [email-masked]
Subject: Respond only to SSL requests?

Hello, list . . .

I've got a website that uses Apache, mod_ssl and HTTP authentication.
Apache only listens on one port, and the only protocol I want to support
on it is HTTPS.  This is almost working okay: Apache won't serve up any
pages if the client is using ordinary HTTP.  It just gives a "Bad Request"
response.

However, because I'm using HTTP authentication, Apache still
challenges the browser even if it's trying to use HTTP, which means that
if someone mistypes the URL (typing http://host:port/ instead of
https://host:port/), the password will be sent over the internet without
encryption.  Granted, Apache won't actually serve up any PAGES once
the user's authenticated over HTTP (it'll just throw the "Bad Request"
message), but I'd rather that the passwords couldn't be sent that way
at all.

Is there any way to get Apache to completely disregard any regular HTTP
traffic?  I'm running Apache 1.3.24 and mod_ssl 2.8.8.

Thanks much in advance, and apologies for the badly-worded request.  My
communication skills seem to be severely malfunctioning this morning.  :)

-CJ
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: David Marshall <[email-masked]>
Date: Fri, 5 Apr 2002 12:57:49 -0800

I do this on a location by location basis

    <Location    /loca>
    Redirect seeother /loca https://www.yoursite.com/loca
    </Location>

    <Location    /locb>
    Redirect seeother /locb https://www.yoursite.com/locb
    </Location>

This may fit your need without mod_rewrite

-----Original Message-----
From: CJ Kucera [mailto:[email-masked]]
Sent: Friday, April 05, 2002 12:40 PM
To: [email-masked]
Subject: Re: Respond only to SSL requests?

On Fri, Apr 05, 2002 at 05:21:44PM +0200, Danalien wrote:
> I'm no expert, but thought of redirecting all http (port 80)
> to https (port 443)? Using the redirect (and or redirectmatch)
> directive(s), http://httpd.apache.org/docs/mod/mod_alias.html#redirect
> 
> Something like,
> 
> Redirect / https://www.yousite.com/

> HTTPS using a "Redirect seeother".

Hrm, yeah, I suppose something like that would work.  I'd probably end
up using mod_rewrite instead, so that it'd match more than just "/".
Still, I'd prefer a cleaner version wherein HTTP traffic is just ignored
completely.  Whatever.  I'll just use a RewriteRule.

Thanks much for your help!

-CJ