-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
I'm no expert, but thought of redirecting all http (port 80) to https (port 443)? Using the redirect (and or redirectmatch) directive(s), http://httpd.apache.org/docs/mod/mod_alias.html#redirect Something like, Redirect / https://www.yousite.com/ >Hello, list . . . > >I've got a website that uses Apache, mod_ssl and HTTP authentication. >Apache only listens on one port, and the only protocol I want to support >on it is HTTPS. This is almost working okay: Apache won't serve up any >pages if the client is using ordinary HTTP. It just gives a "Bad Request" >response. > >However, because I'm using HTTP authentication, Apache still >challenges the browser even if it's trying to use HTTP, which means that >if someone mistypes the URL (typing http://host:port/ instead of >https://host:port/), the password will be sent over the internet without >encryption. Granted, Apache won't actually serve up any PAGES once >the user's authenticated over HTTP (it'll just throw the "Bad Request" >message), but I'd rather that the passwords couldn't be sent that way >at all. > >Is there any way to get Apache to completely disregard any regular HTTP >traffic? I'm running Apache 1.3.24 and mod_ssl 2.8.8. > >Thanks much in advance, and apologies for the badly-worded request. My >communication skills seem to be severely malfunctioning this morning. :) > >-CJ // with regards // ID :: danalien :: <[EMAIL PROTECTED]> PGP Public Key Fingerprint: C891 D3A1 427A A5E7 449F B19E 1E85 A109 -----BEGIN PGP SIGNATURE----- Version: PGPsdk version 1.7.1 (C) 1997-1999 Network Associates, Inc. and its affiliated companies. iQA/AwUBPK2y+R6FoQlEaqKIEQJb0ACfVLaYMXCiSym89mDJOW+A9mYQzl0AoOab 1pqQ7vtVhHx8fL0nsWWX8Ed6 =PMD/ -----END PGP SIGNATURE----- ______________________________________________________________________ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [EMAIL PROTECTED] Automated List Manager [EMAIL PROTECTED]
