# Rewrite non-ssl to ssl except for given location

**URL:** <https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906>\
**Category:** NGINX\
**Created:** [April 15, 2012, 5:22pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906 "2012-04-15T17:22:34Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gurdipe\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b77776/32.png) [@Gurdipe\_D](https://www.ruby-forum.com/u/Gurdipe_D)\
**Post date:** [April 15, 2012, 5:22pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/1 "2012-04-15T17:22:34Z")

</div>

Hi everybody,

I’m using an internal proxy for one of my websites (just a PHP script  
which does a curl request for a given script).

I’ve forced every non-ssl location to ssl with this:

> rewrite ^/(.\*) https://$host/$1 permanent;

The thing is that my scripts doesn’t need SSL as it’s internal, so I  
want to force SSL except for a given location:

> location = /includes/api.php {  
> }  
> rewrite ^/(.\*) https://$host/$1 permanent;

## Unfortunately, this isn’t enough and queries to /includes/api.php?foo=bar still sends me a 301 redirect. Am I missing something ? Thanks for your help.

Cordialement, Adnan RIHAN.  
Président-Fondateur de l’association (de loi 1901) Virtual-Info  
([http://www.virtual-info.info/](http://www.virtual-info.info/)), hébergeur Web et Serveurs de Jeux.  
Consultant ([http://rihan.fr/](http://rihan.fr/))-Technicien Supérieur en Informatique de  
Gestion.  
Ambassadeur Qt ([YOURLS — Your Own URL Shortener | https://lyt.me/](http://lyt.me/7E)) (Projet Tag-PG  
([http://rihan.fr/fr/projets/tagpg](http://rihan.fr/fr/projets/tagpg))).

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 5:29pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/2 "2012-04-15T17:29:23Z")

</div>

2012/4/15 Adnan RIHAN [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> The thing is that my scripts doesn’t need SSL as it’s internal, so I want to  
> force SSL except for a given location:
> 
> location = /includes/api.php {  
> }  
> rewrite ^/(.\*) https://$host/$1 permanent;
> 
> Unfortunately, this isn’t enough and queries to /includes/api.php?foo=bar  
> still sends me a 301 redirect.  
> Am I missing something ?

location / {  
return 301 https://$host$request\_uri;  
}  
location = /includes/api.php {  
…  
}

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 5:34pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/3 "2012-04-15T17:34:22Z")

</div>

> location / {  
> return 301 https://$host$request\_uri;  
> }  
> location = /includes/api.php {  
> …  
> }

The problem is that I’m on a web hosting service which allow s customers  
to edit an included config file.  
So, “location /” is a duplicate 😕

Isn’t there a way to write “location [not matching] /includes/api.php  
{}” ?

* * *

Cordialement, Adnan RIHAN.  
Président-Fondateur de l’association (de loi 1901) Virtual-Info  
([http://www.virtual-info.info/](http://www.virtual-info.info/)), hébergeur Web et Serveurs de Jeux.  
Consultant ([http://rihan.fr/](http://rihan.fr/))-Technicien Supérieur en Informatique de  
Gestion.  
Ambassadeur Qt ([YOURLS — Your Own URL Shortener | https://lyt.me/](http://lyt.me/7E)) (Projet Tag-PG  
([http://rihan.fr/fr/projets/tagpg](http://rihan.fr/fr/projets/tagpg))).

Le dimanche 15 avril 2012 à 17:28, Edho A. a écrit :

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 5:43pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/4 "2012-04-15T17:43:43Z")

</div>

On 15 April 2012 16:32, Adnan RIHAN [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Isn’t there a way to write “location [not matching] /includes/api.php {}” ?

The method mentioned above _is_ the canonical way to do that. It’s in  
the docs somewhere.

Anything else will be a hack of some kind, strongly influenced by your  
specific nginx setup. You’ll need to give more complete information  
about the nuances of the shared hosting setup in order for someone to  
work out if there’s a way to achieve what you want to.

> * * *
> 
> Cordialement, Adnan RIHAN.  
> Président-Fondateur de l’association (de loi 1901) Virtual-Info, hébergeur

You have the wrong signature separator here. It’s not “—”  
(dash-dash-dash), it’s "-- " (dash-dash-space).

## Jonathan

Jonathan M.  
Oxford, London, UK

> **[Jonathan Matthews :: Words Typed, Great Rates For Cash](https://www.jpluscplusm.com)**

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 5:44pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/5 "2012-04-15T17:44:57Z")

</div>

2012/4/15 Adnan RIHAN [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> 

This is valid:

```
location / {
  location / {
  }
}

```

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 6:51pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/6 "2012-04-15T18:51:27Z")

</div>

On 15 April 2012 17:16, Adnan RIHAN [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> listen 80;  
> location ~ /.ht {  
> proxy\_buffer\_size 32k;  
> proxy\_set\_header X-Real-IP $remote\_addr;  
> proxy\_buffers 16 32k;  
> include “/etc/cpnginx/custom/example.com”;  
> }
> 
> The only file I can modify is this one: /etc/cpnginx/custom/example.com

I don’t understand how this could ever work. The only entry point  
you’ve shown to the @apache location is if the URI’s path ends in  
“.(jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|iso|doc|xls|exe|pdf|ppt|txt|tar|mid|midi|wav|bmp|rtf|mp3|ogv|ogg|flv|swf|mpeg|mpg|mpeg4|mp4|avi|wmv|js|css)”

That doesn’t include “.php”, so I don’t see how control of  
“/includes/api.php” ever hits the file you can amend.

Assuming there’s something I’m missing here and .php does in fact  
reach that file, here’s how you might achieve what you want. It uses  
PCRE negative lookaheads, which I don’t know definitely work inside  
nginx.

```
rewrite ^/(?!includes/api\.php) https://$http_host$uri?$args;

```

For what it’s worth, I personally wouldn’t use a host that enforced  
these restrictions on my configuration, like OVH appear to be doing  
here. It’s _extremely_ unpleasant.

## HTH, Jonathan

Jonathan M.  
Oxford, London, UK

> **[Jonathan Matthews :: Words Typed, Great Rates For Cash](https://www.jpluscplusm.com)**

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 7:13pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/7 "2012-04-15T19:13:15Z")

</div>

Actually, I’m the CEO of that host.

The thing is that we’re using CPanel, and a module called CPNginx.  
I’ve send some features requests like moving the include and/or changing  
some positions. I’ve also asked them to add a “custom field” in the  
customer’s panel to allow customers to edit their config (which will  
only be the include file).

Currently, I’m editing by hands included files, and I can’t change the  
way cpnginx rebuild vhosts because it’s scripts are ioncubed T\_T

## So, I’m hacking as I can.

I don’t get what you’re “missing”. PHP Files are never matched because  
there is no location block including them.  
I’ve put my rewrite outside any blocks actually.

## Thank your for your help, I’ll check this soon.

Cordialement, Adnan RIHAN.  
Président-Fondateur de l’association (de loi 1901) Virtual-Info  
([http://www.virtual-info.info/](http://www.virtual-info.info/)), hébergeur Web et Serveurs de Jeux.  
Consultant ([http://rihan.fr/](http://rihan.fr/))-Technicien Supérieur en Informatique de  
Gestion.  
Ambassadeur Qt ([YOURLS — Your Own URL Shortener | https://lyt.me/](http://lyt.me/7E)) (Projet Tag-PG  
([http://rihan.fr/fr/projets/tagpg](http://rihan.fr/fr/projets/tagpg))).

Le dimanche 15 avril 2012 à 18:50, Jonathan M. a écrit :

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 7:16pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/8 "2012-04-15T19:16:21Z")

</div>

By the way,  
rewrite ^/(?!includes/api.php) https://$http\_host$uri?$args;

Is working weeeell, thank you 🙂

–  
Cordialement, Adnan RIHAN.  
Président-Fondateur de l’association (de loi 1901) Virtual-Info  
([http://www.virtual-info.info/](http://www.virtual-info.info/)), hébergeur Web et Serveurs de Jeux.  
Consultant ([http://rihan.fr/](http://rihan.fr/))-Technicien Supérieur en Informatique de  
Gestion.  
Ambassadeur Qt ([YOURLS — Your Own URL Shortener | https://lyt.me/](http://lyt.me/7E)) (Projet Tag-PG  
([http://rihan.fr/fr/projets/tagpg](http://rihan.fr/fr/projets/tagpg))).

Le dimanche 15 avril 2012 à 18:50, Jonathan M. a écrit :

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 6:17pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/9 "2012-04-15T18:17:20Z")

</div>

@Jonathan: okok

Here is the known but can’t be touched vhost file:

> root /home/example/public\_html;
> 
> ```
> proxy_redirect http://www.example.com:8888 http://www.example.com;
> 
> ```
> 
> client\_body\_buffer\_size 512k;  
> proxy\_set\_header Host $host;  
> proxy\_set\_header X-Real-IP $remote\_addr;  
> proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
> }  
> include “/etc/cpnginx/custom/example.com”;  
> }

The only file I can modify is this one: /etc/cpnginx/custom/example.com

For forcing SSL, here is what I wrote in the custom file:

> root@shadow [/etc/cpnginx/custom]# cat [example.com](http://example.com)  
> rewrite ^/(.\*) https://$host/$1 permanent;

## I’ve also changed my signature 😉

Cordialement, Adnan RIHAN.  
Président-Fondateur de l’association (de loi 1901) Virtual-Info  
([http://www.virtual-info.info/](http://www.virtual-info.info/)), hébergeur Web et Serveurs de Jeux.  
Consultant ([http://rihan.fr/](http://rihan.fr/))-Technicien Supérieur en Informatique de  
Gestion.  
Ambassadeur Qt ([YOURLS — Your Own URL Shortener | https://lyt.me/](http://lyt.me/7E)) (Projet Tag-PG  
([http://rihan.fr/fr/projets/tagpg](http://rihan.fr/fr/projets/tagpg))).

Le dimanche 15 avril 2012 à 17:42, Jonathan M. a écrit :

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 7:23pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/10 "2012-04-15T19:23:47Z")

</div>

That’s what I answered, it’s working and thank you.  
And sorry for being a host which enforce strange configs, but I’m  
currently trying to do better, and it’s not easy (as the dev of the  
softwares I’m using are a bit short-minded…).

Have a nice day !

–  
Cordialement, Adnan RIHAN.  
Président-Fondateur de l’association (de loi 1901) Virtual-Info  
([http://www.virtual-info.info/](http://www.virtual-info.info/)), hébergeur Web et Serveurs de Jeux.  
Consultant ([http://rihan.fr/](http://rihan.fr/))-Technicien Supérieur en Informatique de  
Gestion.  
Ambassadeur Qt ([YOURLS — Your Own URL Shortener | https://lyt.me/](http://lyt.me/7E)) (Projet Tag-PG  
([http://rihan.fr/fr/projets/tagpg](http://rihan.fr/fr/projets/tagpg))).

Le dimanche 15 avril 2012 à 19:20, Jonathan M. a écrit :

---

<div class="post-metadata">

**Author:** ![Adnan\_RIHAN](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/4af34b/32.png) [@Adnan\_RIHAN](https://www.ruby-forum.com/u/Adnan_RIHAN)\
**Post date:** [April 15, 2012, 7:20pm UTC](https://www.ruby-forum.com/t/rewrite-non-ssl-to-ssl-except-for-given-location/218906/11 "2012-04-15T19:20:41Z")

</div>

On 15 April 2012 17:57, Adnan RIHAN [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:  
[snip]

> I don’t get what you’re “missing”. PHP Files are never matched because there  
> is no location block including them.  
> I’ve put my rewrite outside any blocks actually.

Ah; your indenting fooled me into thinking your include was the last  
line of the @apache location. Now that I’ve noticed it’s /outside/ any  
location, I can see how it works. The negative lookahead should work  
fine here 🙂

## Jonathan

Jonathan M.  
Oxford, London, UK

> **[Jonathan Matthews :: Words Typed, Great Rates For Cash](https://www.jpluscplusm.com)**