Skip to content

Instantly share code, notes, and snippets.

@nathnolt
Created June 29, 2023 20:43
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save nathnolt/a9397d94bae17cacafbcf42238f2d002 to your computer and use it in GitHub Desktop.
Save nathnolt/a9397d94bae17cacafbcf42238f2d002 to your computer and use it in GitHub Desktop.
Apache Rewrite to HTTPS only when supported by browser vhosts / htaccess
# I only have used it inside of my vhosts file, but I think it should also work in .htaccess
RewriteEngine on
# rewrite to https.
# -----------------
# %{HTTP:X-Forwarded-Proto} !https: This condition checks if the X-Forwarded-Proto header is not set to https.
# The X-Forwarded-Proto #header is typically set by proxies or load balancers to indicate the original protocol
# used for the request. By checking this header, # you can ensure that the redirect only occurs if the request
# is not already using HTTPS.
RewriteCond %{HTTP:X-Forwarded-Proto} !https
# %{HTTP:Upgrade-Insecure-Requests} ^1$: This condition checks if the Upgrade-Insecure-Requests header is set to 1.
# The Upgrade-Insecure-Requests header is sent by modern browsers that support HTTPS and can automatically upgrade
# an insecure request to a secure one. By checking this header, you can verify if the browser supports HTTPS and
# wants to upgrade the request to HTTPS.
RewriteCond %{HTTP:Upgrade-Insecure-Requests} ^1$
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L]
@nathnolt
Copy link
Author

nathnolt commented Jun 29, 2023

This makes it possible to use your website with browsers which don't support https

Not sure if it also works for browsers which support an older version of https

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment