Thursday, July 30, 2009

Gotcha Of The Day: SSL website ignoring .htaccess file

I needed to put quick Apache RewriteRule fix in place on a website, so I decided to add the rules to the .htaccess file. For the life of me, I couldn't get the rules to take effect.

After much poking around, I realized that the rules were being observed for the http version of the site, but the https version was ignoring them.

After still more digging, I could find plenty of folks talking about how to limit rules to just non-https pages, but I couldn't find anyone suggesting that SSL version of the .htaccess file would normally be ignored.

Then it hit me - the VirtualHost definition for the SSL site is a totally separate configuration than the non-SSL site. And that was the key, I had:

<VirtualHost *:80>
    ServerName something.com
    DocumentRoot /var/www/vhosts/something
    ...
    <Directory /var/www/vhosts/something>
        AllowOverride All
    </Directory>
</VirtualHost>

<VirtualHost *:443>
    ServerName something.com:443
    DocumentRoot /var/www/vhosts/something
    ...
</VirtualHost>

I had an AllowOverride clause in the non-SSL virtual host, but not in the SSL version. The result: the non-SSL version was observing the .htaccess file, the SSL version was ignoring it.

I added that clause in to the SSL version, restarted the server, and I was good to go.

9 comments:

  1. The actual problem seems to be that the information provided in the documentation on htaccess files lacks a notification about this issue. All rules (not only mod_rewrite) are ignored, but most people only notice the mod_rewrite ignorance since it affects the availability of their website. The difference with other problems is that the mod_rewrite log will stay empty when requesting a https site: this is _the_ indicator that your htaccess files are ignored as a whole.

    ReplyDelete
  2. Anonymous7:26 AM

    Ah yes. Obvious once you think of it. I now have one include file which contain the site specific settings and a http and https file which contain the server settings which include the include file. Now it all makes sense. :-)

    ReplyDelete
  3. Anonymous11:18 AM

    Dude, you rock! Thanks for the help!

    ReplyDelete
  4. Anonymous3:55 PM

    Thank you kind Sir!

    ReplyDelete
  5. Anonymous9:32 AM

    Thanks for this - I was slowly losing my mind trying to work this one out!

    ReplyDelete
  6. Hi

    I have the same problem but the solution isnt working. htaccess for SSL is completely ignored. Help! Pulling my hair out.

    ReplyDelete
  7. I cant thank you enough. If you are ever in my town, I owe you a beer. Just drop a note. :)

    ReplyDelete
  8. Anonymous9:03 AM

    Exactly what i'm looking for!
    Thank you so much!

    ReplyDelete