mod_rewrite REQUEST_URI confusion

Question

I want to force ssl access on an entire site, except for the following pages:

• www.example.com/loans_and_lines/home_loans.html www.example.com/cards
• www.example.com/cards/international-ministries.html
• www.example.com/cards/international-ministries/donation-3.html
• www.example.com/locations_and_contacts/

Force ssl:

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !^/personal/loans_and_lines/home_loans\.html
RewriteCond %{REQUEST_URI} !^/cards/$
RewriteCond %{REQUEST_URI} !^/cards/international\-ministries\.html
RewriteCond %{REQUEST_URI} !^/cards/international\-ministries/donation\-3\.html
RewriteCond %{REQUEST_URI} !^/locations_and_contacts/$
RewriteRule (.*) https://www.example.com$1 [R=301,L]

However neither of the /cards or /locations_and_contacts and any of the pages are being excluded from being served with ssl access. Can someone tell me what's wrong with my set of rules?

Solution

:)

...

You forgot the "OR" directive. Here's what should work (and maybe you've forgotten the QSA directive in the redirect as well (maybe not)):

# Force SSL
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !^/personal/loans_and_lines/home_loans\.html [OR]
RewriteCond %{REQUEST_URI} !^/cards/$ [OR]
RewriteCond %{REQUEST_URI} !^/cards/international\-ministries\.html [OR]
RewriteCond %{REQUEST_URI} !^/cards/international\-ministries/donation\-3\.html [OR]
RewriteCond %{REQUEST_URI} !^/locations_and_contacts/$
RewriteRule (.*) https://www.example.com$1 [QSA,R=301,L]

Two hints:

---

Please try to use the RewriteLog directive: it helps you to track down such problems:

# Trace:
# (!) file gets big quickly, remove in prod environments:
RewriteLog "/web/logs/mywebsite.rewrite.log"
RewriteLogLevel 9
RewriteEngine On

---

My favorite tool to check for regexp:

http://www.quanetic.com/Regex (don't forget to choose ereg(POSIX) instead of preg(PCRE)!)

Comments

[Alpha01]

Wow, I completely forgot about the [OR] directive.

[Olivier Pons]

You could optimize your rewrite cond in 2 line, but it would be less "readable".

[Simon East]

[OR] would not work in this particular example, as it would still redirect ALL requests to HTTPS.

[Artjom B.]

There are comments on your answer which were posted as answers: i.stack.imgur.com/i8piK.png

[Christian Wolf]

Your answer seems logically wrong to me. You must not use [OR] as the options are mutually exclusive. This will trigger each request.