Enforcing https connection

Question

Hello folks! I have managed to get authentication at least partly set up but am mystified as to why security isn't working... In my httpd.conf file for ssl I have....

<Directory /usr/local/apache2.2/cgi-bin/oia>
    SSLRequireSSL
    Satisfy All
    AuthType     basic
    AuthName     "Protected Intranet Area"
    AuthUserFile conf/.passwd
    AuthGroupFile conf/groups
    Require      valid-user
</Directory>

I do have the user password in the setup and when accessing the page via https://....../cgi-bin/oia, it does correctly prompt me for the user name and password. Problem is if I use the same URL with http:// there's no prompting for a user name or password.

Any advice is greatly appreciated. Nikki

Answer 1

You could set up a mod_rewrite rule to always forward the http://x.y.com to https://x.y.com (which is probably what you want to do anyway)