What is the difference between HTTP_HOST and HTTPS_HOST in apache .htaccess files?

Question

I'm editing an .htaccess file..

In RewriteCondition for RewriteRules, HTTPS_HOST seems to only match urls that are accessed via https:// protocol (ssl). I saw in docs somewhere that it's a T/F variable that indicates if the url was accessed using the secure protocol.

However, I'm having trouble finding on the docs whether HTTP_HOST only matches http:// protocols, or if it effectively matches // relative protocols, meaning it matches both http:// and https://.

Can someone confirm one way or the other, or point me to a definitive source for this info?

Also, if HTTP_HOST matches both protocol variants, what is the best way to filter for matches of only http:// protocols ?

Example:

<IfModule mod_rewrite.c> RewriteEngine on Rewritecond %{HTTP_HOST} ^\/\.(?!some-url).*$ RewriteRule (.*) https://www.example.com/$1 [R=301,L,NC] </IfModule> 

In contrast:

... Rewritecond %{HTTPS_HOST} ^\/\.(?!some-url).*$ ... 

Edit: Experimentation shows that HTTP_HOST does seem to match both protocols, whereas HTTPS_HOST only matches when the protocol, or url starts with https://.

.

(Note re: apache2 tag
TBH, I am not certain what version of apache I am running. To try finding out, so I could attach the proper tag..
I tried httpd -v, apache -v, apache2ctl -S, apachectl -S, httpd -S, etc. (It's not a virtualhost question, and I have nginx, which is think is for that (virtual server) anyway, but I tried those last 3 (virtualhost) commands anyway to see if they would enlighten me on my apache version).
Responses to those commands say either that I must first install apache2, or it is an unknown command.
I have an /etc/apache2 folder, but not an /usr/local/apache (hence no /usr/local/apache/bin/httpd folder).
)

Answer 1

There is no such Apache server variable HTTPS_HOST, only HTTP_HOST. If HTTPS_HOST is set on your server then it's specific to your server.

The HTTP_HOST server variable contains the value of the Host HTTP request header (ie. the hostname), this is irrespective of the protocol used (HTTP or HTTPS). As with all variables that start HTTP_, they contain the value of the respective HTTP request header.

Maybe you're thinking of the HTTPS Apache server variable? This contains the value on or off depending on whether the request is over HTTPS or not. So, providing you don't have a front-end proxy that manages SSL then it is the HTTPS server variable you use to determine whether the request is over HTTP or HTTPS protocol.

Reference:

• Apache 2.4 - RewriteCond Directive

and I have nginx

So, what are you using Nginx for? Is it your application server? Or are you using it as a front end proxy? In which case, HTTPS might not be the variable to use after all.

---

UPDATE:

Rewritecond %{HTTP_HOST} ^\/\.(?!some-url).*$ RewriteRule (.*) https://www.example.com/$1 [R=301,L,NC] 

This doesn't really make sense. The condition (RewriteCond directive) will never be successful (because the Host header never contains a slash), so the redirect will never occur.

As mentioned above, the HTTP_HOST server variable contains the hostname only, eg. example.com or www.example.com. It does not contain the URL-path, as you appear to be assuming here. Your condition is trying to match a literal /. not followed by some-url (using a negative lookahead). The hostname will never start with (or even contain) a slash, so it fails at the first character.

I'm trying to modify an htaccess rule that was blocking letsencrypt renewals, .... So there is the primary issue (.well-known was getting a 403)

To make an exception on a specific rule for a specific URL-path, you would do something like the following:

Rewritecond %{REQUEST_URI} !^/\.well-known RewriteRule (.*) https://www.example.com/$1 [R=301,L,NC] 

This excludes (note the ! prefix) any URL that starts /.well-known. The ! prefix on the CondPattern negates the regex. The REQUEST_URI server variable contains the full URL-path from the request (which naturally excludes the protocol, hostname and query string).

However, you state that ".well-known was getting a 403" - you may need to find out what was triggering the 403 and apply an exception to that rule.

OR, include a single exception at the very top of your .htaccess file:

# Any requests that start "/.well-known" are ignored RewriteRule ^\.well-known - [L] 

(Note the absence of the slash prefix on the RewriteRule pattern that matches the URL-path.)

Initially (and maybe secondarily now also) I thought requiring https on an expired certificate might be a problem.

Yes, that will certainly be a problem. The user will get a browser warning that the certificate is invalid and the request will never reach your server.