I'm using Drupal 7.  The login page for my users is located at /user/login, so the default login path.  I need that page to be encrypted using SSL so people aren't transmitting their passwords in the clear.

I have Apache configured so that the site can be navigated either over HTTP or HTTPS.  However, I want to implement some rewrite rules so that all requests other than /user/login are made over HTTP because it is INFINITELY faster and will result in a better user experience.  I refuse to use [Secure Pages][1] at this point in time because of the bugged support in Drupal Core and I'm not going to patch Core manually.  That means I'm left with using Apache rewrite rules.

I have the following rules:

    <VirtualHost *:80>
      ...
      RewriteCond %{HTTPS} off
      RewriteCond %{REQUEST_URI} ^/user/login$
      RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [L,R]
      ...
    </VirtualHost>
    
    <VirtualHost *:443>
      ...
      RewriteCond %{HTTPS} on
      RewriteCond %{REQUEST_URI} !^/user/login$
      RewriteRule ^/(.*) http://%{HTTP_HOST}/$1 [L,R]
      ...
    </VirtualHost>

Now to me that makes sense, but Drupal doesn't seem to like it.

What's happening is as follows:
1) If I navigate around the site using HTTP to any page other than /user/login, it works fine.
2) If I navigate to /user/login over HTTP, I get redirected to the front page.
3) If I navigate to any page over HTTPS, I get redirected to the front page over HTTP.

Any help would be appreciated.


  [1]: http://drupal.org/project/securepages