forcing domain *without* www

[sneakyimp]

I'm working to set up a website such that certain pages are properly hosted via HTTPS. This involves some redirects should users try to access a page via HTTP that requires HTTPS. To prevent users from being logged out when SSL is required (i.e., if they get redirected from www.example.com to example.com), I'm attempting to canonicalise the url so that all accesses top the site refer to the domain without the 'www'. We need to do it without the 'www' because the security cert is for the bare domain. What's the best way to do this with apache?

I'm considering mod_rewrite but this requires two sets of rules. One for HTTP and one for HTTPS. I am a mediocre mod_rewrite jockey and so would appreciate comments on this approach:

# for NON-https
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L,QSA]

# for https
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L,QSA]

Does that look OK? I seem to recall that simple insertion of https might not be fully secure and that there were more specific SSL parameters which might be necessary here.

[bradgrafelman]

Can't you just change the cookies (I'm assuming you're using cookies?) to be set for all subdomains rather than just one?

[sneakyimp]

It has been my experience that cookies are not the only problem. I want to avoid any access to the site using www because if the user happens to click into a securely hosted page, they will get a certificate error when visiting https://www.example.com.

I noticed an error in my prior rewrite rules. Here's the corrected version:

# for NON-https
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L,QSA]

# for https
RewriteCond %{HTTPS} =on
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [R=301,L,QSA]

Although it does occur to me that if the user visits a securely hosted www.example.com then they would get a certificate error because the server barfs up the cert before mod_rewrite comes into play. hrm.