Require SSL for ACP?

[Thomas P]

Hello,

it would be nice to have an option 'Require SSL for ACP' before login.

I know this could be easily done via htaccess, but we use htaccess to passwort protect the acp directory and mod_auth is handled first.
So before a redirect to SSL can occur, the password prompt appears - data entered is transmitted via http, which is unsecure...

Thanks for ideas

[hgb]

have you tried this?

SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire %{HTTP_HOST} eq "site.com" #or www.site.com
ErrorDocument 403 https://site.com

An interesting thing when using the mod_ssl instead of mod_rewrite to force SSL is that apache gives mod_ssl priority ABOVE mod_rewrite so it will always require SSL.

EDIT: LINK

hope that helps

[Thomas P]

Yes, this would work - but: The directory is protected via password (htaccess), since mod_auth is handled always first you would have to enter the password before the SSL Require, which makes nada sense...