How to REQUIRE an SSL Connection?

twilson

I searched all over the board for this, I thought for sure there'd be a post about it but I sure couldn't find one...

I'm simply wondering how you can require a page to use SSL? If the client is not accessing the page securely I want it to redirect to the secure page. My host allows me to make all pages secure/unsecure simply by changing the URL (no separate www/wwws directories), so I want to deter people that might try accessing a page unsecurely by removing the "s" from https.

Thanks In Advance,
Tom

matt_4013

Hi, there's 2 things you could use.

These are the $SERVER['HTTP_PROTOCOL'] and the $SERVER['SERVER_PORT'] superglobals.

Basically, you'd just do a check,

$ssl_port = "443";
if($_SERVER['SERVER_PORT'] != $ssl_port) {

header("Location: https://".$_SERVER['HTTP_HOST']."/".$_SERVER['PHP_SELF']."?".$_SERVER['QUERY_STRING']);
exit;

twilson

Of course. Thanks matt 🙂

Tom

natehk

This code-----

$ssl_port = "443";
if($_SERVER['SERVER_PORT'] != $ssl_port) {

header("Location: [url]https://[/url]".$SERVER['HTTP_HOST']."/".$SERVER['PHP_SELF']."?".$_SERVER['QUERY_STRING']);
exit;

Should lool like this

$ssl_port = "443";
if($_SERVER['SERVER_PORT'] != $ssl_port) {

header("Location: [url]https://[/url]".$SERVER['HTTP_HOST'].$SERVER['PHP_SELF']."?".$_SERVER['QUERY_STRING']);
exit;

the change is--> $SERVER['HTTP_HOST'].$SERVER

The orignal code would cause errors when you liked off of it.
Good Luck..

natehk

my typo linked not "liked" . sorry🙁

matt_4013

Ummm, natehk, this thread is 3 weeks old. Why resurrect a resolved thread for a typo correction?

Anyway, it's not like it's a huge problem. Apache will ignore the extra slash, and IIS will strip it.

Proof:
http://www.microsoft.com///games/
http://httpd.apache.org////docs/misc/FAQ.html

natehk

I was looking for the same thing to use on Apache and it would not work. After I looked at it for a bit, I made the changes and everything worked. My intent was only to help others that may have the same problem, not to worry about a typo. I know my time is important and I feel the same about others. The code was exactly what I was looking for and it gave me the idea to use the $_SERVER[????] and not to hard code it inside http.conf. Thanks for the idea🙂
P.S. We all do typooos

matt_4013

I just reread what I wrote, realized it sounded kind of hostile :p That wasn't my intention, was simply curious 🙂

alfa

I'm also trying to require an SSL connection.

However I get a parse error on the first line of this script.

$ssl_port = "443";

if($_SERVER['SERVER_PORT'] != $ssl_port)
{
header("Location: [url]https://[/url]".$_SERVER['HTTP_HOST']
.$_SERVER['PHP_SELF']
."?"
.$_SERVER['QUERY_STRING']);
exit;
}

Thankful for any input

alfa

Hi again,

I found this in one of the other threads, and that solved my problem!

if($HTTP_SERVER_VARS["HTTPS"] != "on")
{
$newurl = "https://" . $_SERVER["SERVER_NAME"] . $_SERVER["REQUEST_URI"]; 
header("location: $newurl"); 
}

Thanks to Datona for that one.