[Webdev] Web security (https)

[adam]

Hi Conor,

> I am using an Apache server which uses a digital certificate for security.
> How so you dynamically specify that a page should be https:// rather than
> http:// Do you specify it when opening the page using a link or can you
> list the files which require security somewhere?
>
If you want to /force/ HTTPS on some files or directories, you'll need to
configure it explicitly. You can do this with the Apache rewrite module, or
you can do it programatically in the files themselves. For example, with
mod_rewrite (locking files under /secure/ to HTTPS):

---
# Turn on the rewrite engine
RewriteEngine on
# IF the request is under /secure/
RewriteCond %{REQUEST_URI) ^/secure/
# AND IF the port is NOT 443 (HTTPS)
RewriteCond %{SERVER_PORT) !^443$
# Send the request to HTTPS
RewriteRule /(.*) https://www.server.com/$1
---

Or, with PHP:

---
<?php
// IF the port is not 443 (HTTPS)
if (getenv('SERVER_PORT') != 443) {
	// Send the request to HTTPS
	header('Location: https://' . getenv('SERVER_NAME') .
getenv('REQUEST_URI'));
}
?>
---

[These are really simple examples, they're not in context; they don't check
for errors; and they don't cater for, for example, a QUERY_STRING.]

adam