在请求用户身份验证之前,Apache .htaccess重定向到HTTPS

Question

这是我的.htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

AuthUserFile /etc/hi
AuthName "hi"
AuthType Basic
require valid-user

它要求使用http进行用户身份验证,这意味着密码将以纯文本形式发送.它将重定向到https版本并再次询问密码.

我该如何解决？

Answer 1

如果您正在运行Apache 2.4,则可以使用配置部分轻松解决此问题.

例如...

# Redirect to HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]

# Authenticate users only when using HTTPS
# Enable for <v2.4
 # SSLRequireSSL
 # ErrorDocument 403 /secure-folder/
# Enable for >v2.4
<If "%{HTTPS} == 'on'">
    AuthType Basic
    AuthName "Special things"
    AuthUserFile /etc/blah.htpasswd
    # Prevent this 'Require' directive from overriding any merged previously
   <IfVersion >= 2.4>
      AuthMerging And
   </IfVersion>
    Require valid-user
# Enable for >v2.4
</If>

Answer 2

我这样绕过它.只允许非SSL,因为它将被重定向,然后在SSL上需要auth一次...

SetEnvIf %{SERVER_PORT} ^80$ IS_NON_SSL

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

AuthUserFile /etc/hi
AuthName "hi"
AuthType Basic
require valid-user
Allow from env=IS_NON_SSL

Answer 3

非常感谢,Istador!

我的Apache版本为2.2(Synology NAS DSM 5.1),所以这两个不适用于它:

RewriteOptions Inherit
IfVersion

拿出它们(以及版本> = 2.4的部分)后.整件事开始为我工作.

对于这个主题有很多建议,我花了两天时间试用它们.

但只有这一个适合我.

这是我做的:

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]

AuthType Basic
AuthName "private area"
AuthUserFile /path/to/file/.htdigest

Order Deny,Allow
Deny from all
Satisfy Any
Allow from env=!HTTPS
Require valid-user

因此,它已经过验证,适用于Apache 2.2,Synology DSM 5.1.