I'm trying to force SSL with .htaccess on a shared host. This means there I only have access to .htaccess and not the vhosts config. I know you can put a rule in the VirtualHost config file to force SSL which will be picked up there (and acted upon first), preventing double authentication, but I can't get to that. Here's the progress I've made:Config 1This works pretty well but it does force double authentication if you visit http://site.com - once for http and then once for https. Once you are logged in, it automatically redirects http://site.com/page1.html to the https coutnerpart just fine:RewriteEngine OnRewriteCond %{HTTPS} !=onRewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]RewriteEngine onRewriteCond %{HTTP_HOST} !(^www\.site\.com*)$RewriteRule (.*) https://www.site.com$1 [R=301,L]AuthName LockedAuthUserFile /home/.htpasswdAuthType Basicrequire valid-userConfig 2If I add this to the top of the file, it works a lot better in that it will switch to SSL before prompting for the password:SSLOptions +StrictRequireSSLRequireSSLSSLRequire %{HTTP_HOST} eq site.comErrorDocument 403 https://site.comIt's clever how it will use the SSLRequireSSL option and the ErrorDocument403 to redirect to the secure version of the site. My only complaint is that if you try and access http://site.com/page1.html it will redirect to https://site.com/So it is forcing SSL without a double-login, but it is not properly forwarding non-SSL resources to their SSL counterparts.Regarding the first config, Insyte mentioned using mod_rewrite to perform a simple redirect is a bit of overkill. Use the Redirect directive instead. It's possible this may even fix your problem, as I believe mod_rewrite rules are some of the last directives to be processed, just before the file is actually grabbed from the filesystemI have not had no such luck on finding a force-ssl config option with the redirect directive and so have been unable to test this theory.
Properly force SSL with .htaccess, no double authentication
apache;https;mod rewrite;htaccess;url rewriting
If you have server-side execution such as php or cgi, then set your ErrorDocument to a file that does not require authentication.  This file should redirect the client to the proper location.  Apache will set several REDIRECT_ - prefixed environment variables to help you out, and the original environment is preserved -- see http://httpd.apache.org/docs/trunk/custom-error.html.In your .htaccess, do as your second example above, but make the ErrorDocument an internal document:SSLOptions +StrictRequireSSLRequireSSLSSLRequire %{HTTP_HOST} eq site.comErrorDocument 403 /err_redirect.phpAuthName LockedAuthUserFile /home/.htpasswdAuthType Basicrequire valid-user<Files /err_redirect.php>  AuthType none</Files>Then, in that error document, send the appropriate HTTP status and Location header. Here's a simple example in php:<?php    header(Location: https:// . $_SERVER[HTTP_HOST] . $_SERVER[REQUEST_URI]);?>