I'm trying to serve a Kaltura video running on CentOS 6+ on one server, by plugging the Object code for embedded video inside a node body (or even using the Kaltura Drupal module), running on a Drupal 7 multisite on Ubuntu 10.04LTS.

Most browsers accept it but Chrome, which denies the request as being insecure content. We serve all our D7 sites on HTTPS, forced redirect. But now I want to only serve ONE of the multisite as HTTP so that it could show this Kaltura video, and not have Chrome hiccup.

Here's what I have in the .htaccess file of the D7 parent directory.

RewriteCond %{HTTPS} off
RewriteCond %{Request_URI} !^(/mysite/user)
RewriteRule ^(/.*) http://%{HTTP_HOST}%{REQUEST_URI} [NC,R=301]

I've tried the Secure Login module, as well as the very close suggestions here - Redirect /user/login to HTTPS, all other requests to HTTP, to straight mode rewrite on apache - https://stackoverflow.com/questions/1816119/using-mod-rewrite-how-do-i-force-https-for-certain-paths-and-http-for-all-othe - and nothing makes sense.

Note: Not a mod-rewrite expert, but I now feel this is somehow attributed to not doing something correctly with Drupal. Currently, when you visit http://mydomain.com/mysite/user - I get this message:

You are accessing <mysite> using an unencrypted connection. For your
security, <mysite> only supports account logins using
a secure protocol such as HTTPS.

I believe this is a very popular question, but didn't really see anyone else trying to go from secure to insecure on multisite. Please advise. Thanks,!

1 Answer 1


Maybe you should try and and change the object embed code code to use a protocal-relative URL such as //YOURSITENAME.COM/some/path/to/video/file.mp4 you can do this easily with a WYSIWYG editor or like hook_node_view and regexing for your domain url and an object tag and removing the http:// or https:// as needed ...

Simply google for protocol-relative url and you'll find a bunch of information.

  • I'll go ahead and try this today, but do I rely on the protocol-relative url WITH the rewrite rules? (I suppose there's one way to find out..)
    – Robbase
    May 9, 2013 at 14:25
  • You only get a warning from Chrome if your page is HTTPS and some piece of embedded content or iframe is non-HTTPS. The protocol-relative url will keep your embedded content url in sync with however the page was fetched. Whether or not you want the page itself HTTPS or not is your own business logic.
    – tenken
    May 9, 2013 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.