php - 使用 .htaccess 和 mod_rewrite 强制 SSL/https

Question

如何使用 PHP 中特定的 .htaccess 和 mod_rewrite 页面强制使用 SSL/https。

Answer 1

对于 Apache，您可以使用 mod_ssl使用 SSLRequireSSL Directive 强制 SSL :

This directive forbids access unless HTTP over SSL (i.e. HTTPS) is enabled for the current connection. This is very handy inside the SSL-enabled virtual host or directories for defending against configuration errors that expose stuff that should be protected. When this directive is present all requests are denied which are not using SSL.

虽然这不会重定向到 https。要重定向，请使用 mod_rewrite 尝试以下操作在你的 .htaccess 文件中

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

或在

中给出的各种方法中的任何一种

• http://www.askapache.com/htaccess/http-https-rewriterule-redirect.html

如果您的提供商禁用了 .htaccess，您也可以在 PHP 中解决此问题(这不太可能，因为您要求它，但无论如何)

if (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') {
    if(!headers_sent()) {
        header("Status: 301 Moved Permanently");
        header(sprintf(
            'Location: https://%s%s',
            $_SERVER['HTTP_HOST'],
            $_SERVER['REQUEST_URI']
        ));
        exit();
    }
}