Apache .htaccess 在要求用户身份验证之前重定向到 HTTPS [英] Apache .htaccess redirect to HTTPS before asking for user authentication

问题描述

这是我的 .htaccess:

This is my .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

AuthUserFile /etc/hi
AuthName "hi"
AuthType Basic
require valid-user

它要求使用 http 进行用户身份验证，这意味着密码将以纯文本形式发送.它会重定向到 https 版本并再次询问密码.

It asks for user authentication using http, meaning that password will be sent in plain text. It will than redirect to the https version and ask the password again.

我该如何解决?

推荐答案

我是这样解决的.只允许非 SSL，因为它将被重定向，然后需要在 SSL 上进行一次身份验证...

I get around it this way. Just allow Non-SSL since it will be redirected then require auth once on SSL...

SetEnvIf %{SERVER_PORT} ^80$ IS_NON_SSL

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

AuthUserFile /etc/hi
AuthName "hi"
AuthType Basic
require valid-user
Allow from env=IS_NON_SSL

这篇关于Apache .htaccess 在要求用户身份验证之前重定向到 HTTPS的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！