htaccess rewrite rule to https let my apps stop working

classic Classic list List threaded Threaded
9 messages Options
Reply | Threaded
Open this post in threaded view
|

htaccess rewrite rule to https let my apps stop working

Ben Rubinstein via use-livecode
Hello,

I attached a certificate to our domain and started switching our domain /
web from http to https, because of the security alerts of some browsers
saying that our site isn't safe. So far so good. Our web hoster recommended
to put a rewrite rule into the htaccess to redirect all http calls on https.
So far so good. That works fine with all URLs in a browser.

BUT all of my LiveCode programs with http:// calls for php programs on my
server don't work anymore. I get different errors.

I am not good with what is happening behind the scenes of htaccess rewrite
rules and have no idea if and what I could do, beside of changing all http
calls in my LC programs to https. My thinking was, that the rewrite rule
would just switch each http call to https on the server, but keeps finding
all html and php files. That works obviously fine with all URLs in a
browser. But why doesn't my LC program likes that rewriting? The PHP
programs should be found the same with https and should return the wanted
value as with http - or not? How is LiveCode affected by this rewrite?

I can't just change all URLs in all my LC programs from http to https,
because my customers have lots of old version of my programs out there,
which are not anymore maintained, which were created with any very old LC
version I don't know anymore, etc.

Any light on what is going wrong to my LC URL calls and if there is anything
I can do is highly appreciated.

Tiemo

 

 

_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode
Reply | Threaded
Open this post in threaded view
|

Re: htaccess rewrite rule to https let my apps stop working

Ben Rubinstein via use-livecode
On 2017-08-18 13:58, Tiemo Hollmann TB via use-livecode wrote:

> Hello,
>
> I attached a certificate to our domain and started switching our domain
> /
> web from http to https, because of the security alerts of some browsers
> saying that our site isn't safe. So far so good. Our web hoster
> recommended
> to put a rewrite rule into the htaccess to redirect all http calls on
> https.
> So far so good. That works fine with all URLs in a browser.

I wonder if using a URL redirect, rather than rewrite might work better:

https://www.digitalocean.com/community/tutorials/how-to-create-temporary-and-permanent-redirects-with-apache-and-nginx

I might be wrong here but I think rewriting just changes the path which
apache uses to determine what to return; a redirect causes a
'Redirection' return value to the client so the client can refetch at
the (redirected) URL.

> I can't just change all URLs in all my LC programs from http to https,
> because my customers have lots of old version of my programs out there,
> which are not anymore maintained, which were created with any very old
> LC
> version I don't know anymore, etc.

Unless the distributed versions built with old versions of LiveCode were
built with HTTPS support built-in then they are very unlikely to work
with either a redirect or rewrite.

Even if you do a redirect/rewrite on the server, the client has to be
able to handle the protocol which the server produces correctly.

Warmest Regards,

Mark.

--
Mark Waddingham ~ [hidden email] ~ http://www.livecode.com/
LiveCode: Everyone can create apps

_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode
Reply | Threaded
Open this post in threaded view
|

Re: htaccess rewrite rule to https let my apps stop working

Ben Rubinstein via use-livecode
In reply to this post by Ben Rubinstein via use-livecode
Hi Tiemo,

we are using the following code in the htaccess to redirect  http:// request (either with or without www) to https://www.multitronic.de <https://www.multitronic.de/>

RewriteEngine on
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^yourdomain.com <http://yourdomain.com/>$ [NC,OR]
RewriteCond %{HTTP_HOST} ^www.yourdomain.com <http://www.yourdomain.com/>$ [NC]
RewriteRule (.*) https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1> [R=301,L]
RewriteCond %{HTTP_HOST} ^yourdomain.com <http://yourdomain.com/>$ [NC]
RewriteRule (.*) https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1> [R=301,L]


if the sample code is mixed up then you´ll find it also here as text file for download

https://dl.qck.nu//?dl=sample_htaccess.txt <https://dl.qck.nu//?dl=sample_htaccess.txt>


HTH
Matthias


> Am 18.08.2017 um 13:58 schrieb Tiemo Hollmann TB via use-livecode <[hidden email] <mailto:[hidden email]>>:
>
> Hello,
>
> I attached a certificate to our domain and started switching our domain /
> web from http to https, because of the security alerts of some browsers
> saying that our site isn't safe. So far so good. Our web hoster recommended
> to put a rewrite rule into the htaccess to redirect all http calls on https.
> So far so good. That works fine with all URLs in a browser.
>
> BUT all of my LiveCode programs with http:// calls for php programs on my
> server don't work anymore. I get different errors.
>
> I am not good with what is happening behind the scenes of htaccess rewrite
> rules and have no idea if and what I could do, beside of changing all http
> calls in my LC programs to https. My thinking was, that the rewrite rule
> would just switch each http call to https on the server, but keeps finding
> all html and php files. That works obviously fine with all URLs in a
> browser. But why doesn't my LC program likes that rewriting? The PHP
> programs should be found the same with https and should return the wanted
> value as with http - or not? How is LiveCode affected by this rewrite?
>
> I can't just change all URLs in all my LC programs from http to https,
> because my customers have lots of old version of my programs out there,
> which are not anymore maintained, which were created with any very old LC
> version I don't know anymore, etc.
>
> Any light on what is going wrong to my LC URL calls and if there is anything
> I can do is highly appreciated.
>
> Tiemo
>
>
>
>
>
> _______________________________________________
> use-livecode mailing list
> [hidden email] <mailto:[hidden email]>
> Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
> http://lists.runrev.com/mailman/listinfo/use-livecode

_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode
Reply | Threaded
Open this post in threaded view
|

Re: htaccess rewrite rule to https let my apps stop working

Ben Rubinstein via use-livecode
Hi Tiemo,

it´s messed up.
Please use the link
https://dl.qck.nu//?dl=sample_htaccess.txt <https://dl.qck.nu//?dl=sample_htaccess.txt>
to download the textfile.

I´ve forgot to mention that you have to replace yourdomain.com <http://yourdomain.com/> with your domain.

Matthias

> Am 18.08.2017 um 14:25 schrieb Matthias Rebbe via use-livecode <[hidden email] <mailto:[hidden email]>>:
>
> Hi Tiemo,
>
> we are using the following code in the htaccess to redirect  http:// request (either with or without www) to https://www.multitronic.de <https://www.multitronic.de/> <https://www.multitronic.de/ <https://www.multitronic.de/>>
>
> RewriteEngine on
> RewriteCond %{HTTPS} off
> RewriteCond %{HTTP_HOST} ^yourdomain.com <http://yourdomain.com/> <http://yourdomain.com/ <http://yourdomain.com/>>$ [NC,OR]
> RewriteCond %{HTTP_HOST} ^www.yourdomain.com <http://www.yourdomain.com/> <http://www.yourdomain.com/ <http://www.yourdomain.com/>>$ [NC]
> RewriteRule (.*) https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1> <https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1>> [R=301,L]
> RewriteCond %{HTTP_HOST} ^yourdomain.com <http://yourdomain.com/> <http://yourdomain.com/ <http://yourdomain.com/>>$ [NC]
> RewriteRule (.*) https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1> <https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1>> [R=301,L]
>
>
> if the sample code is mixed up then you´ll find it also here as text file for download
>
> https://dl.qck.nu//?dl=sample_htaccess.txt <https://dl.qck.nu//?dl=sample_htaccess.txt> <https://dl.qck.nu//?dl=sample_htaccess.txt <https://dl.qck.nu//?dl=sample_htaccess.txt>>
>
>
> HTH
> Matthias
>

_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode
Reply | Threaded
Open this post in threaded view
|

AW: htaccess rewrite rule to https let my apps stop working

Ben Rubinstein via use-livecode
In reply to this post by Ben Rubinstein via use-livecode
Hi Mark,

I think the oldest version was build with LC 6.7. As far as I can see that
version supports https.
Is there any characteristic on the standalone, to identify the engine
version used?
I will give a redirect a try. Thanks for your ideas

Tiemo

-----Ursprüngliche Nachricht-----
Von: use-livecode [mailto:[hidden email]] Im Auftrag
von Mark Waddingham via use-livecode
Gesendet: Freitag, 18. August 2017 14:15
An: How to use LiveCode <[hidden email]>
Cc: Mark Waddingham <[hidden email]>
Betreff: Re: htaccess rewrite rule to https let my apps stop working

On 2017-08-18 13:58, Tiemo Hollmann TB via use-livecode wrote:
> Hello,
>
> I attached a certificate to our domain and started switching our
> domain / web from http to https, because of the security alerts of
> some browsers saying that our site isn't safe. So far so good. Our web
> hoster recommended to put a rewrite rule into the htaccess to redirect
> all http calls on https.
> So far so good. That works fine with all URLs in a browser.

I wonder if using a URL redirect, rather than rewrite might work better:

https://www.digitalocean.com/community/tutorials/how-to-create-temporary-and
-permanent-redirects-with-apache-and-nginx

I might be wrong here but I think rewriting just changes the path which
apache uses to determine what to return; a redirect causes a 'Redirection'
return value to the client so the client can refetch at the (redirected)
URL.

> I can't just change all URLs in all my LC programs from http to https,
> because my customers have lots of old version of my programs out
> there, which are not anymore maintained, which were created with any
> very old LC version I don't know anymore, etc.

Unless the distributed versions built with old versions of LiveCode were
built with HTTPS support built-in then they are very unlikely to work with
either a redirect or rewrite.

Even if you do a redirect/rewrite on the server, the client has to be able
to handle the protocol which the server produces correctly.

Warmest Regards,

Mark.

--
Mark Waddingham ~ [hidden email] ~ http://www.livecode.com/
LiveCode: Everyone can create apps

_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription
preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode


_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode
Reply | Threaded
Open this post in threaded view
|

AW: htaccess rewrite rule to https let my apps stop working

Ben Rubinstein via use-livecode
In reply to this post by Ben Rubinstein via use-livecode
Hi Matthias,
Thanks for your example, I'll give it a try
using these Rewrite rules, you could stay with plain http:// URLs in your LC code? And LC doesn't notice the difference and everything works as before? Do you call PHPs on your server? Could there be a difference between html and php calls with return values?
Tiemo


-----Ursprüngliche Nachricht-----
Von: use-livecode [mailto:[hidden email]] Im Auftrag von Matthias Rebbe via use-livecode
Gesendet: Freitag, 18. August 2017 14:42
An: How to use LiveCode <[hidden email]>
Cc: Matthias Rebbe <[hidden email]>
Betreff: Re: htaccess rewrite rule to https let my apps stop working

Hi Tiemo,

it´s messed up.
Please use the link
https://dl.qck.nu//?dl=sample_htaccess.txt <https://dl.qck.nu//?dl=sample_htaccess.txt>
to download the textfile.

I´ve forgot to mention that you have to replace yourdomain.com <http://yourdomain.com/> with your domain.

Matthias

> Am 18.08.2017 um 14:25 schrieb Matthias Rebbe via use-livecode <[hidden email] <mailto:[hidden email]>>:
>
> Hi Tiemo,
>
> we are using the following code in the htaccess to redirect  http://
> request (either with or without www) to https://www.multitronic.de 
> <https://www.multitronic.de/> <https://www.multitronic.de/ 
> <https://www.multitronic.de/>>
>
> RewriteEngine on
> RewriteCond %{HTTPS} off
> RewriteCond %{HTTP_HOST} ^yourdomain.com <http://yourdomain.com/>
> <http://yourdomain.com/ <http://yourdomain.com/>>$ [NC,OR] RewriteCond
> %{HTTP_HOST} ^www.yourdomain.com <http://www.yourdomain.com/>
> <http://www.yourdomain.com/ <http://www.yourdomain.com/>>$ [NC]
> RewriteRule (.*) https://www.yourdomain.com/$1 
> <https://www.yourdomain.com/$1> <https://www.yourdomain.com/$1 
> <https://www.yourdomain.com/$1>> [R=301,L] RewriteCond %{HTTP_HOST}
> ^yourdomain.com <http://yourdomain.com/> <http://yourdomain.com/ 
> <http://yourdomain.com/>>$ [NC] RewriteRule (.*)
> https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1>
> <https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1>>
> [R=301,L]
>
>
> if the sample code is mixed up then you´ll find it also here as text
> file for download
>
> https://dl.qck.nu//?dl=sample_htaccess.txt 
> <https://dl.qck.nu//?dl=sample_htaccess.txt>
> <https://dl.qck.nu//?dl=sample_htaccess.txt 
> <https://dl.qck.nu//?dl=sample_htaccess.txt>>
>
>
> HTH
> Matthias
>

_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode


_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode
Reply | Threaded
Open this post in threaded view
|

Re: htaccess rewrite rule to https let my apps stop working

Ben Rubinstein via use-livecode
Hi Tiemo,
although i was pretty sure that this works here i´ve checked again.
From the message box i called an .lc script  which exports db data. I used http:// as prefix and the data was returned w/o a problem.

Calling the same url from browser works the same. It isautomatically redirected by the server and the data is returned.

We are calling lc and php scripts on our server from our programs to fetch data and all is working.

Btw.: Maybe this is of interest for the one or the other.
Today we´ve created the first Rapidweaver page which uses a livecode server script for form processing and db access directly in a stack instead of showing that lc script in a frame. I´ve never have thought that this will work. It´s very simple to integrate.




> Am 18.08.2017 um 15:28 schrieb Tiemo Hollmann TB via use-livecode <[hidden email]>:
>
> Hi Matthias,
> Thanks for your example, I'll give it a try
> using these Rewrite rules, you could stay with plain http:// URLs in your LC code? And LC doesn't notice the difference and everything works as before? Do you call PHPs on your server? Could there be a difference between html and php calls with return values?
> Tiemo
>
>
> -----Ursprüngliche Nachricht-----
> Von: use-livecode [mailto:[hidden email]] Im Auftrag von Matthias Rebbe via use-livecode
> Gesendet: Freitag, 18. August 2017 14:42
> An: How to use LiveCode <[hidden email]>
> Cc: Matthias Rebbe <[hidden email]>
> Betreff: Re: htaccess rewrite rule to https let my apps stop working
>
> Hi Tiemo,
>
> it´s messed up.
> Please use the link
> https://dl.qck.nu//?dl=sample_htaccess.txt <https://dl.qck.nu//?dl=sample_htaccess.txt>
> to download the textfile.
>
> I´ve forgot to mention that you have to replace yourdomain.com <http://yourdomain.com/> with your domain.
>
> Matthias
>> Am 18.08.2017 um 14:25 schrieb Matthias Rebbe via use-livecode <[hidden email] <mailto:[hidden email]>>:
>>
>> Hi Tiemo,
>>
>> we are using the following code in the htaccess to redirect  http://
>> request (either with or without www) to https://www.multitronic.de 
>> <https://www.multitronic.de/> <https://www.multitronic.de/ 
>> <https://www.multitronic.de/>>
>>
>> RewriteEngine on
>> RewriteCond %{HTTPS} off
>> RewriteCond %{HTTP_HOST} ^yourdomain.com <http://yourdomain.com/>
>> <http://yourdomain.com/ <http://yourdomain.com/>>$ [NC,OR] RewriteCond
>> %{HTTP_HOST} ^www.yourdomain.com <http://www.yourdomain.com/>
>> <http://www.yourdomain.com/ <http://www.yourdomain.com/>>$ [NC]
>> RewriteRule (.*) https://www.yourdomain.com/$1 
>> <https://www.yourdomain.com/$1> <https://www.yourdomain.com/$1 
>> <https://www.yourdomain.com/$1>> [R=301,L] RewriteCond %{HTTP_HOST}
>> ^yourdomain.com <http://yourdomain.com/> <http://yourdomain.com/ 
>> <http://yourdomain.com/>>$ [NC] RewriteRule (.*)
>> https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1>
>> <https://www.yourdomain.com/$1 <https://www.yourdomain.com/$1>>
>> [R=301,L]
>>
>>
>> if the sample code is mixed up then you´ll find it also here as text
>> file for download
>>
>> https://dl.qck.nu//?dl=sample_htaccess.txt 
>> <https://dl.qck.nu//?dl=sample_htaccess.txt>
>> <https://dl.qck.nu//?dl=sample_htaccess.txt 
>> <https://dl.qck.nu//?dl=sample_htaccess.txt>>
>>
>>
>> HTH
>> Matthias
>>
>
> _______________________________________________
> use-livecode mailing list
> [hidden email]
> Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
> http://lists.runrev.com/mailman/listinfo/use-livecode
>
>
> _______________________________________________
> use-livecode mailing list
> [hidden email]
> Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
> http://lists.runrev.com/mailman/listinfo/use-livecode

_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode
Reply | Threaded
Open this post in threaded view
|

Re: AW: htaccess rewrite rule to https let my apps stop working

tbodine
In reply to this post by Ben Rubinstein via use-livecode
T.

Had a similar experience while migrating my site to https. What I found was my standalones were missing the revsecurity.dll external. After rebuilding those to include revsecurity.dll, the standalones were able to contact my site and access stacks and other files there without changing my links from http to https, since the htaccess was managing that.

Notes: On Windows, that must be at the same level as the standalone exe itself rather than the externals folder. And codesign your externals as well as standalones.

HTH,
Tom B.

 

Reply | Threaded
Open this post in threaded view
|

Re: htaccess rewrite rule to https let my apps stop working

Ben Rubinstein via use-livecode
In reply to this post by Ben Rubinstein via use-livecode
T.

Yes mod-rewrite is the way to go. What Matthias sent is how we are doing it.

but for backwards compatibility in our apps I also include a function to

replace http://  with https://

in any URL in our apps.

BR

 
 

_______________________________________________
use-livecode mailing list
[hidden email]
Please visit this url to subscribe, unsubscribe and manage your subscription preferences:
http://lists.runrev.com/mailman/listinfo/use-livecode