# Redirect to https

**URL:** <https://discourse.cakephp.org/t/redirect-to-https/1412>\
**Category:** Need Help\
**Created:** [November 1, 2016, 6:18am UTC](https://discourse.cakephp.org/t/redirect-to-https/1412 "2016-11-01T06:18:49Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![calzone](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/calzone/32/305_2.png) [@calzone](https://discourse.cakephp.org/u/calzone)\
**Post date:** [November 1, 2016, 6:18am UTC](https://discourse.cakephp.org/t/redirect-to-https/1412/1 "2016-11-01T06:18:49Z")

</div>

Is there a correct way/place to globally redirect from http to https?

I’m currently doing it in my .htaccess file but I would prefer to do it in the code and make it a per-server config setting.

---

<div class="post-metadata">

**Author:** ![seagrinch](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@seagrinch](https://discourse.cakephp.org/u/seagrinch)\
**Post date:** [November 3, 2016, 5:32pm UTC](https://discourse.cakephp.org/t/redirect-to-https/1412/2 "2016-11-03T17:32:09Z")

</div>

I use the Security component for this. See the second example in the “Usage” section.  
[http://book.cakephp.org/3.0/en/controllers/components/security.html#usage](http://book.cakephp.org/3.0/en/controllers/components/security.html#usage)

---

<div class="post-metadata">

**Author:** ![calzone](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/calzone/32/305_2.png) [@calzone](https://discourse.cakephp.org/u/calzone)\
**Post date:** [November 6, 2016, 12:51am UTC](https://discourse.cakephp.org/t/redirect-to-https/1412/3 "2016-11-06T00:51:36Z")

</div>

I implemented this and found it broke my controllers’ return this-\>redirects  
as in, they didn’t redirect at all. Flash worked, but no redirect.

---

<div class="post-metadata">

**Author:** ![raul338](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/raul338/32/69_2.png) [@raul338](https://discourse.cakephp.org/u/raul338)\
**Post date:** [November 6, 2016, 12:56am UTC](https://discourse.cakephp.org/t/redirect-to-https/1412/4 "2016-11-06T00:56:29Z")

</div>

Can you specify why not/can’t do it on the .htaccess? I don’t know what you mean by “per-server” (do you have multiple applications in the same domain?)  
I prefer it because is transparent for the application.

---

<div class="post-metadata">

**Author:** ![calzone](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/calzone/32/305_2.png) [@calzone](https://discourse.cakephp.org/u/calzone)\
**Post date:** [November 7, 2016, 7:18pm UTC](https://discourse.cakephp.org/t/redirect-to-https/1412/5 "2016-11-07T19:18:53Z")

</div>

I have a single codebase with an admin page to automatically “publish” code updates from Dev to Test, and then from Test to Production (and other flavors as well). Along the way, not all servers will have HTTPS running.

If I use .htaccess, the .htaccess file gets copied over as part of it. So I don’t want to have SSL redirects that fail on non-HTTPS servers. I tried looking up a way to implement server-dependent SSL redirects, but came up empty handed. It seems like .htaccess can either check for SSL status or server name, but not both.

---

<div class="post-metadata">

**Author:** ![ali](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/ali/32/123_2.png) [@ali](https://discourse.cakephp.org/u/ali)\
**Post date:** [November 7, 2016, 9:16pm UTC](https://discourse.cakephp.org/t/redirect-to-https/1412/6 "2016-11-07T21:16:07Z")

</div>

What would be a concrete example of a link that needs to be http on one server and https on another?

I have a couple of sites where I work on a non-ssl dev environment and upload to a server with ssl, but since relative urls resolve appropriately by default I never had any reason to do any kind of manual configuration…

---

<div class="post-metadata">

**Author:** ![calzone](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/calzone/32/305_2.png) [@calzone](https://discourse.cakephp.org/u/calzone)\
**Post date:** [November 8, 2016, 8:19pm UTC](https://discourse.cakephp.org/t/redirect-to-https/1412/7 "2016-11-08T20:19:31Z")

</div>

In my case, the client wants to require SSL on the production server but not on a demonstration server.

So we have two different .htaccess files in webroot. In one case, it forces SSL if the user neglected to type https or followed a link from an email without it — in the other case, it doesn’t enforce SSL because the server doesn’t support it and it would cause errors.

---

<div class="post-metadata">

**Author:** ![ali](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/ali/32/123_2.png) [@ali](https://discourse.cakephp.org/u/ali)\
**Post date:** [November 8, 2016, 9:27pm UTC](https://discourse.cakephp.org/t/redirect-to-https/1412/8 "2016-11-08T21:27:27Z")

</div>

Oh, I see, I didn’t totally get your question XD

So if you want to redirect to http or https in your code instead of an .htaccess, you should do it in the AppController’s beforeFilter.

Something along the lines of this should do the trick:

```
if ( !$this->request->is('ssl') )
	{
		$this->redirect( str_replace('http://', 'https://', Router::url('', true )) );
	}

```

Pretty basic and self-explanatory. You can combine that with your config quite easily.

**EDIT** : Actually, Router::url() is no good since it doesn’t contain params, so something simpler, albeit less cake-y makes more sense:

```
if ( !$this->request->is('ssl') ){

	$schema = 'https://';

	$this->redirect( $schema . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] );
}

```

This is easier to work with, though, since there’s no need to replace anything.