Problem/Motivation

Drupal 9 core ships with the following lines in .htaccess as example for (non-) www. redirects:

# If your site can be accessed both with and without the 'www.' prefix, you
  # can use one of the following settings to redirect users to your preferred
  # URL, either WITH or WITHOUT the 'www.' prefix. Choose ONLY one option:
  #
  # To redirect all users to access the site WITH the 'www.' prefix,
  # (http://example.com/foo will be redirected to http://www.example.com/foo)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} .
  # RewriteCond %{HTTP_HOST} !^www\. [NC]
  # RewriteRule ^ http%{ENV:protossl}://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  #
  # To redirect all users to access the site WITHOUT the 'www.' prefix,
  # (http://www.example.com/foo will be redirected to http://example.com/foo)
  # uncomment the following:
  # RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
  # RewriteRule ^ http%{ENV:protossl}://%1%{REQUEST_URI} [L,R=301]

(See https://git.drupalcode.org/project/drupal/-/blob/9.4.x/.htaccess)

which is good as it's quite typical to only have one canonical domain and prevent duplicate content problems.

On the other hand it's also quite typical to redirect to https (SSL) for what there's no example in the .htaccess, but documentation on https://www.drupal.org/https-information

On the other hand, the documented SSL redirect snippets on the documentation page, combined with the .htaccess example needs two redirects in some combinations, like for example if the user enters http://example.com (or others, dependent on the order of the rewrite rules).

In my opinion, there are two things that should be discussed to improve:

  1. Why are examples for (non) www. redirects in the .htaccess but not for SSL redirects
  2. For the most typical case: Redirecting to SSL + www. shouldn't we provide an example snippet (in .htaccess or docs) which only needs ONE 301 redirect (example below - to be checked carefully)

I'd be happy about the discussion :) Thank you!

Steps to reproduce

Set up a Drupal site with https://www. as primary domain (which is very typical) and configure .htaccess accordingly.

Proposed resolution

Check this snippet and decide to add it to the .htaccess or documentation page:

# Redirect all users to the site WITH https:// AND www. (in one redirect):
  RewriteCond %{HTTP:X-Forwarded-Proto} !https [NC]
  RewriteCond %{HTTPS} off [OR]
  RewriteCond %{HTTP_HOST} !^www\. [NC]
  RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
  RewriteRule ^ https://www.%1%{REQUEST_URI} [L,NE,R=301]

If we add something like that, we'd also need the vice-versa version to redirect to non-www!

Remaining tasks

TBD

User interface changes

None

API changes

None

Data model changes

None

Release notes snippet

TBD

Issue fork drupal-3256945

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

Anybody created an issue. See original summary.

anybody’s picture

Just found this issue from Dropsolid in dropsolid_rocketship where they fixed this: #3159964: Improve example for https redirect in .htaccess
Commit: https://git.drupalcode.org/project/dropsolid_rocketship/-/commit/7637808...

Sadly, it wasn't proposed as a fix for core.

anybody’s picture

Title: Add example to .htaccess how to redirect to www. and SSL in one step » Redirect to www. and SSL in one step in .htaccess
Issue tags: +SEO
anybody’s picture

Version: 10.0.x-dev » 10.1.x-dev

Added a first idea how this might be implemented. Would be happy to get some feedback and more ideas.
Untested yet!

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

volker23’s picture

Proposed solution works like a charme, would love to see this in core!

anybody’s picture

Status: Active » Needs review

@Volker23: Please RTBC it then, if you think it's fine! :)

anybody’s picture

Perhaps someone could create a further MR against 11.x-dev?

smustgrave’s picture

Status: Needs review » Needs work
Issue tags: +Needs framework manager review

Tagging for framework manager as changing the htaccess seems like a big deal.

But a 11.x will be needed, not sure feature requests are backported to 10.x still.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.