ホームページ > 記事 > php教程 > HTTP/HTTPS, without index.php, using htaccess, plus XHR

HTTP/HTTPS, without index.php, using htaccess, plus XHR

WBOYオリジナル: 2016-06-06 19:54:043196ブラウズ

Removing index.php and forcing HTTP/HTTPS I have read many posts about people trying to force HTTPS for some views and returning to HTTP for others. I struggled with this for a while too but I think this solution is pretty solid. First of

Removing index.php and forcing HTTP/HTTPS

I have read many posts about people trying to force HTTPS for some views and returning to HTTP for others. I struggled with this for a while too but I think this solution is pretty solid.

First of all, having your base_url automatically adjust between http and https makes everything much easier. This way all your base_url() and site_url() calls have the proper protocol.

$config['base_url'] = "http".((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == "on") ? "s" : "")."://".$_SERVER['HTTP_HOST'].str_replace(basename($_SERVER['SCRIPT_NAME']),"",$_SERVER['SCRIPT_NAME']);

Starting with the usual htaccess file:

You can then check whether HTTPS is on or not with:

RewriteCond %{HTTPS} off RewriteCond %{HTTPS} on 

For example, to force HTTPS on all pages you could use the following:

RewriteCond %{HTTPS} off RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301] 

To force HTTPS on some pages:

RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} (auth|register|secure) RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301] 

To return back to HTTP:

RewriteCond %{HTTPS} on RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301] 

To return back to HTTP on all other pages, you need to add exceptions for the pages that are secure:

RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} (auth|register|secure) RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301] RewriteCond %{HTTPS} on RewriteCond %{REQUEST_URI} !(auth|register|secure) RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301]

To avoid a partially encrypted page, you need to add exceptions for any other URIs you might use such as your images or scripts folder. I like to place everything in a folder called ‘static’ (‘static/images’, ‘static/js’, etc) so I only add one exception for that.

The finished product:

IfModule mod_rewrite.c> RewriteEngine on Options +FollowSymLinks RewriteBase / RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule ^(.*)$ index.php/$1 RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} (auth|register|secure) RewriteRule ^(.*)$ https://%{SERVER_NAME}%{REQUEST_URI} [R=301] RewriteCond %{HTTPS} on RewriteCond %{REQUEST_URI} !(static|auth|register|secure) RewriteRule ^(.*)$ http://%{SERVER_NAME}%{REQUEST_URI} [R=301] IfModule> IfModule !mod_rewrite.c> ErrorDocument 404 /index.php IfModule>

HTTPS and XmlHttpRequests (Ajax)

Not only do XHR calls throw security errors when you try to load content between domains but also between HTTP and HTTPS. Secondly, the headers passed by apache allow browsers to automatically redirect but the XmlHttpRequest object does not.

To solve this you would have to add an exception for any URI that you planned on accessing from one protocol to another.

Example:

RewriteCond %{REQUEST_URI} !(static|auth|register|secure|categories/get_list|products/get_types) =site_url('categories/get_list');?> 

I quickly found out that this became tedious and confusing when I had a lot of requests in a secure environment. Routes to the rescue!

By adding the following to your routes file:

$route['xhr/(:any)'] = '$1'; 

And adding ‘xhr’ to your list of exceptions; you can now call any URI within your application without changing protocols while still allowing the browser to view that controller using another protocol.

RewriteCond %{REQUEST_URI} !(static|xhr|auth|register|secure) =site_url('xhr/categories/get_list');?> 

I hope this has been helpful!

Phil

声明：

この記事の内容はネチズンが自主的に寄稿したものであり、著作権は原著者に帰属します。このサイトは、それに相当する法的責任を負いません。盗作または侵害の疑いのあるコンテンツを見つけた場合は、admin@php.cn までご連絡ください。

前の記事：使用EaglePHP打造自己的网站(非PHP程序员的菜鸟使用手册)次の記事：PHP中日期加减方法

続きを見る

HTTP/HTTPS, without index.php, using htaccess, plus XHR

関連記事