Check if URL is SSL or not in PHP

michaelsanford · 09-28-2005, 09:55 PM

I want to try to check if the page being loaded is being loaded via SSL or not.

I just for SSL working on my Apache 1.3 server and I wanted to insert checks at the index pages of my various apps, like phpMyAdmin, WordPress (admin), to check whether the page was accessed via an https:// link, and if not, you could be redirected to the encrypted page.

I might add that an .htaccess directive, if one exists, would also work for me since all the sensetive files and apps are in their own folders.

I've noticed, however, that there's no such URL checking possible in PHP using the superglobals, like HTTP_* or _SERVER[], since none of those bother to prefix the URL with the protocol. Is there another way to go about it ?

Failing this, I suppose I could always make a subdomain 'admin.' that's only served by an SSL VirtualHost (that doesn't even listen on :80), right ?

Hko · 09-29-2005, 06:54 PM

Quote:

I just for SSL working on my Apache 1.3 server and I wanted to insert checks at the index pages of my various apps, like phpMyAdmin, WordPress (admin), to check whether the page was accessed via an https:// link, and if not, you could be redirected to the encrypted page.

[..snip..]

I've noticed, however, that there's no such URL checking possible in PHP using the superglobals, like HTTP_* or _SERVER[], since none of those bother to prefix the URL with the protocol. Is there another way to go about it ?

That's a mistake. You can do this very well with _SERVER[]:

PHP Code:



if ($_SERVER['HTTPS'] != "on") { 
    $url = "https://". $_SERVER['SERVER_NAME'] . $_SERVER['REQUEST_URI']; 
    header("Location: $url"); 
    exit; 
}

Note: Redirection to the https URL is done above with header(). This will only work if no single (html) output is done before calling header(). In other words: you need to do this before any html-tag, and before any PHP echo or print. This is probably what you want anyway, so this shouldn't be a real problem. Just keep it in mind when it doesn't seem to work.

michaelsanford · 09-29-2005, 08:32 PM

I feel like such a n00b. I was confusing the various SERVER_* variables with the _SERVER[] array.

Thanks for catching me on that one

EDIT: Now that I look back at what phpinfo() outputs, the reason I initially assumed there would beno relevant variable is that the string "https" doesn't appear anywhere on the page.

Web31337 · 04-14-2010, 07:34 AM

There is no such option "out-of-box" if you run PHP as fastcgi server(php-cgi) and connect it with nginx webserver.
If you want to check if it is SSL-connected you may wish to add the following line to your fastcgi params list:

Code:

fastcgi_param  HTTPS		  $ssl_protocol;

or $ssl_cipher variable instead of $ssl_protocol.
Hope it helps someone(I know this thread is 5-years old but still it's on top of google from "php determine if ssl enabled").