forcing people to go to a https instead of http

datona

I have a webpage that I need ALL people to access ONLY via https and not http
Is there a way to have the php redirect people if they go to http://www.domain.com/members/index.php to get forwarded to https://domain.com/members/index.php

This area needs the security as it has sensitive data so I do not want people to access this without using the digital certificate.

eoghain

Check the server variable SERVER_PROTOCOL and if it isn't HTTPS then use [man]header/man to send the user to the https page.

JakesSA

you can also use a bit of jscript to do the same trick!

datona

Yesw, I am just trying to search the net now for some php code that will do the SERVER_PROTOCOL check and redirect if [url]http://[/url]

datona

I tried this:

if ($_SERVER["SERVER_PORT"] == 80) {

header('Refresh: 0; URL=https://domain.com/members/index2.php');
}

Is this the best method?

I also need to check to see if someone is going to:
domain.com
and not
www.domain.com
as the certificate is for domain.com and not www.domain.com

bjwilke

if ($_SERVER['SERVER_PROTOCOL'] != "HTTPS") {
 header("Location: https://....");
}

Should get you there. Haven't tried it though.

datona

Just tried that but the screen freezes and I get lots of PID's under apache.

bjwilke

Then check the content of your 'SERVER_PROTOCOL' var. It's probably something like 'HTTPS/1.0' or something.

Replace the header-command with an echo of the $_SERVER var, or check your phpinfo(), it should be listed there under 'Environment'. The vars listed there should help you with that domain.com problem too.

keyurjbhatt

can any body send me help about difference and improtant of https vs http
pls any document or general help

Cleric

if (!ValidateUser($SESSION["user"], $SESSION["pass"]))
{
header("Location: " . INDEXPATH);
exit;
}

The above is an example in which I use in scripts. Before you output anything to the client, you must make a decision whether or not to redirect them to another place.

If you want everyone to be immediately redirected to another page when they come to a particular one, then I would do this:

<?php

    header("Location: [url]https://somwhere.com[/url]");
    exit;

The exit is important in that it makes the php script stop there because if not, it will continue through the script when you do not want it to.

Hope this helps!

z0r

Why not do this at the webserver level (where it is more appropriate and probably less resource-intensive to do). Apache/IIS/etc. have directives or filters that were designed to do this.

Cleric

The answer to that question depends on the purpose/originator of the script. If it is a web developer who is design an application but doesn't necessarily have the ability to change server level settings such as that, then the designer should do it in code. If there is a different situation which warrants it, then proceed as needed. For me, it is not the duty of the server but the application

dirkoneill

Actually the code is really simple. Here it is:

if( !isset($_SERVER[HTTPS])){
  header(Location: <your secure address>);
  exit();
}

datona

Thanks dirkoneill but that did not work. I did find this piece of code and this works.

if($HTTP_SERVER_VARS["HTTPS"] != "on")

{

$newurl = "https://" . $SERVER["SERVER_NAME"] . $SERVER["REQUEST_URI"];

header("location: $newurl");

}

alfa

I've been searching for days to find a way to do this.

At last finding something that works, WOW!

Thanks again.