Removing index.php and forcing HTTP/HTTPS
I have read many posts about people trying to force HTTPS for some views and returning to HTTP for others. I struggled with this for a while too but I think this solution is pretty solid.
First of all, having your base_url automatically adjust between http and https makes everything much easier. This way all your base_url() and site_url() calls have the proper protocol.
$config['base_url'] = "http".((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == "on") ? "s" : "")."://".$_SERVER['HTTP_HOST'].str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);
Starting with the usual htaccess file:
<IfModule mod_rewrite.c>
RewriteEngine on
Options +FollowSymLinks
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1
</IfModule>
<IfModule !mod_rewrite.c>
ErrorDocument 404 /index.php
</IfModule>
You can then check whether HTTPS is on or not with:
RewriteCond %{HTTPS} off
RewriteCond %{HTTPS} on
For example, to force HTTPS on all pages you could use the following:
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301]
To force HTTPS on some pages:
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} (auth|register|secure)
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301]
To return back to HTTP:
RewriteCond %{HTTPS} on
RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301]
To return back to HTTP on all other pages, you need to add exceptions for the pages that are secure:
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} (auth|register|secure)
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301]
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !(auth|register|secure)
RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301]
To avoid a partially encrypted page, you need to add exceptions for any other URIs you might use such as your images or scripts folder. I like to place everything in a folder called ‘static’ (‘static/images’, ‘static/js’, etc) so I only add one exception for that.
RewriteCond %{REQUEST_URI} !(static|auth|register|secure)
The finished product:
<IfModule mod_rewrite.c>
RewriteEngine on
Options +FollowSymLinks
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} (auth|register|secure)
RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301]
RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} !(static|auth|register|secure)
RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301]
</IfModule>
<IfModule !mod_rewrite.c>
ErrorDocument 404 /index.php
</IfModule>
HTTPS and XmlHttpRequests (Ajax)
Not only do XHR calls throw security errors when you try to load content between domains but also between HTTP and HTTPS. Secondly, the headers passed by apache allow browsers to automatically redirect but the XmlHttpRequest object does not.
To solve this you would have to add an exception for any URI that you planned on accessing from one protocol to another.
Example:
RewriteCond %{REQUEST_URI} !(static|auth|register|secure|categories/get_list|products/get_types)
<?=site_url('categories/get_list');?>
I quickly found out that this became tedious and confusing when I had a lot of requests in a secure environment. Routes to the rescue!
By adding the following to your routes file:
$route['xhr/(:any)'] = '$1';
And adding ‘xhr’ to your list of exceptions; you can now call any URI within your application without changing protocols while still allowing the browser to view that controller using another protocol.
RewriteCond %{REQUEST_URI} !(static|xhr|auth|register|secure)
<?=site_url('xhr/categories/get_list');?>
I hope this has been helpful!
Phil
