CUNY Academic Commons

Cool, thanks Dom. Here are the docs you'll need, specifically RewriteMatch: http://httpd.apache.org/docs/current/mod/mod_alias.html The only trick will be to figure out the regex :)

Thanks Boone, been needing to brush up on my question marks, periods and asterisks as well!! :-)

Been reading up on htaccess and ssl related rewriting and redirecting.

Found a stackoverflow article that discusses a similar redirect issue:

http://stackoverflow.com/questions/3717799/redirecting-https-to-http-via-htaccess?rq=1

The proposed solution is to add this to htaccess:

RewriteCond %{SERVER_PORT} ^443$
RewriteRule ^(.*)$ http://%{HTTP_HOST}/$1 [R=301,L]

However, I can't test this locally because I have no form of SSL setup. Does cdev use the same SSL as the commons? I tried visiting https://cdev.gc.cuny.edu but I get the following error in Chrome:

Error 118 (net::ERR_CONNECTION_TIMED_OUT): The operation timed out.

Where can I test SSL changes to our htaccess file?

Maybe André can set cdev up with a self-signed certificate, so we can test there.

In any case, Dom, that rule won't be enough. That'll prevent users from requesting any https URL. You need to add another RewriteCond along these lines:

RewriteCond %{HTTP_HOST} !(.*?\.)?commons\.gc\.cuny\.edu$

This is totally off the top of my head, and is almost guaranteed not to work :), but it gives you the idea: we need to test whether you're requesting a non-*.commons.gc.cuny.edu.

Thanks Boone.

Sorry, I shoulda been a little more clear, that would be the regex that I start testing with. Without testing feedback on what does and does not redirect I couldn't put anything more descriptive into the update. :-)

I think a self signed cert on cdev would work great.

Guys, cdev already has ssl enabled and a legit, valid certificate installed but also a local firewall blocking port 443 : )

Also I had the web server reserving the ssl vhost to the Fedora Commons installation (institutional repository software).

I'll take a look and set this up for you guys tomorrow, ok?

That works for me Andre, thanks.

Ok, try now please.

Thanks Andre. I'm in class all day today. So I'll either test when I get home tonight or tomorrow afternoon.

Boone,

Is cdev available for testing?

Yes, it's all yours, Dom.

Thanks.

I've disabled FORCE_SSL_LOGIN for domains other than *.commons.gc.cuny.edu. That should have the effect of removing most cases where the user would end up on an https version of a page.

It doesn't appear to be possible to prevent this particular problem with .htaccess. I'm guessing that, by the time the .htaccess file has been read, the browser has already checked the SSL provenance. André, do you have any insight into this?

André, do you have any insight into this?

Browser behavior is notoriously hard to predict, but I think your original idea of redirecting with an htaccess rule is reasonable and worth a try.

having said that, perhaps just having disabled FORCE_SSL_LOGIN for domains other than *.commons.gc.cuny.edu should probably be enough. After all how is anyone going to end up on the https address anyway?

Other than that we could always tell custom domains to BYOSC (bring your own ssl certificate :-)

cool. I'll let the original reporters know and pass on the word when/if the issues arise again.