Return to Question

I'm using Drupal 7. The login page for my users is located at /user/login, so the default login path. I need that page to be encrypted using SSL so people aren't transmitting their passwords in the clear.

I have Apache configured so that the site can be navigated either over HTTP or HTTPS. However, I want to implement some rewrite rules so that all requests other than /user/login are made over HTTP because it is INFINITELY faster and will result in a better user experience. I refuse to use Secure Pages at this point in time because of the bugged support in Drupal Core and I'm not going to patch Core manually. That means I'm left with using Apache rewrite rules.

I have the following rules:

<VirtualHost *:80>
  ...
  RewriteCond %{HTTPS} off
  RewriteCond %{REQUEST_URI} ^/user/login$
  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [L,R]
  ...
</VirtualHost>

<VirtualHost *:443>
  ...
  RewriteCond %{HTTPS} on
  RewriteCond %{REQUEST_URI} !^/user/login$
  RewriteRule ^/(.*) http://%{HTTP_HOST}/$1 [L,R]
  ...
</VirtualHost>

Now to me that makes sense, but Drupal doesn't seem to like it.

What's happening is as follows:

1. If I navigate around the site using HTTP to any page other than /user/login, it works fine.
2. If I navigate to /user/login over HTTP, I get redirected to the front page.
3. If I navigate to any page over HTTPS, I get redirected to the front page over HTTP.

Any help would be appreciated.

I'm using Drupal 7. The login page for my users is located at /user/login, so the default login path. I need that page to be encrypted using SSL so people aren't transmitting their passwords in the clear.

I have Apache configured so that the site can be navigated either over HTTP or HTTPS. However, I want to implement some rewrite rules so that all requests other than /user/login are made over HTTP because it is INFINITELY faster and will result in better user experience. I refuse to use Secure Pages at this point in time because of the bugged support in Drupal Core and I'm not going to patch Core manually. That means I'm left with using Apache rewrite rules.

I have the following rules:

<VirtualHost *:80>
  ...
  RewriteCond %{HTTPS} off
  RewriteCond %{REQUEST_URI} ^/user/login$
  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [L,R]
  ...
</VirtualHost>

<VirtualHost *:443>
  ...
  RewriteCond %{HTTPS} on
  RewriteCond %{REQUEST_URI} !^/user/login$
  RewriteRule ^/(.*) http://%{HTTP_HOST}/$1 [L,R]
  ...
</VirtualHost>

Now to me, that makes sense, but Drupal doesn't seem to like it.

What's happening is as follows:

1. If I navigate around the site using HTTP to any page other than /user/login, it works fine.
2. If I navigate to /user/login over HTTP, I get redirected to the front page.
3. If I navigate to any page over HTTPS, I get redirected to the front page over HTTP.

The login page for my users is located at /user/login, so the default login path. I need that page to be encrypted using SSL so people aren't transmitting their passwords in the clear.

I have Apache configured so that the site can be navigated either over HTTP or HTTPS. However, I want to implement some rewrite rules so that all requests other than /user/login are made over HTTP because it is INFINITELY faster and will result in a better user experience. I refuse to use Secure Pages at this point in time because of the bugged support in Drupal Core and I'm not going to patch Core manually. That means I'm left with using Apache rewrite rules.

I have the following rules:

<VirtualHost *:80>
  ...
  RewriteCond %{HTTPS} off
  RewriteCond %{REQUEST_URI} ^/user/login$
  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [L,R]
  ...
</VirtualHost>

<VirtualHost *:443>
  ...
  RewriteCond %{HTTPS} on
  RewriteCond %{REQUEST_URI} !^/user/login$
  RewriteRule ^/(.*) http://%{HTTP_HOST}/$1 [L,R]
  ...
</VirtualHost>

Now to me that makes sense, but Drupal doesn't seem to like it.

What's happening is as follows:

1. If I navigate around the site using HTTP to any page other than /user/login, it works fine.
2. If I navigate to /user/login over HTTP, I get redirected to the front page.
3. If I navigate to any page over HTTPS, I get redirected to the front page over HTTP.

Any help would be appreciated.

I'm using Drupal 7. The login page for my users is located at /user/login, so the default login path. I need that page to be encrypted using SSL so people aren't transmitting their passwords in the clear.

I have Apache configured so that the site can be navigated either over HTTP or HTTPS. However, I want to implement some rewrite rules so that all requests other than /user/login are made over HTTP because it is INFINITELY faster and will result in a better user experience. I refuse to use Secure Pages at this point in time because of the bugged support in Drupal Core and I'm not going to patch Core manually. That means I'm left with using Apache rewrite rules.

I have the following rules:

<VirtualHost *:80>
  ...
  RewriteCond %{HTTPS} off
  RewriteCond %{REQUEST_URI} ^/user/login$
  RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [L,R]
  ...
</VirtualHost>

<VirtualHost *:443>
  ...
  RewriteCond %{HTTPS} on
  RewriteCond %{REQUEST_URI} !^/user/login$
  RewriteRule ^/(.*) http://%{HTTP_HOST}/$1 [L,R]
  ...
</VirtualHost>

Now to me that makes sense, but Drupal doesn't seem to like it.

What's happening is as follows:

1. If I navigate around the site using HTTP to any page other than /user/login, it works fine.
2. If I navigate to /user/login over HTTP, I get redirected to the front page.
3. If I navigate to any page over HTTPS, I get redirected to the front page over HTTP.

Any help would be appreciated.