title: Force SSL on Apache, with Auth and Canonical redirect
body: <p>I've read some posts on how to redirect to SSL, also some on how to make sure a site is using the www subdomain / canonical name, and some on how to set up Basic Auth. Here is what I have in my .htaccess file right now:</p>
  
  <pre>
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
  
  
  RewriteEngine on
  RewriteCond %{HTTP_HOST} !(^www\.site\.com*)$
  RewriteRule (.*) https://www.site.com$1 [R=301,L]
  
  
  AuthName "Locked"
  AuthUserFile "/home/.htpasswd"
  AuthType Basic
  require valid-user
  </pre>
  
  <p>It works fairly well, but I'd like to optimize it. My questions include:</p>
  
  <ol>
  <li>How do I avoid double authentication? When I access the site w.o. SSL I have to authenticate, and then I am redirected to SSL and have to authenticate again. Can I just be redirected and then authenticated?</li>
  <li><del>It looks like the first rule is pretty awesome because I could use it on any site without modifying it. Can rule #2 be rewritten to be site-independent? ie: it will force www to be used on any site no matter what the domain name is (with a better written rule)? </del><a href="https://serverfault.com/questions/190589/how-to-redirect-non-www-to-www-without-hardcoding-using-htaccess/228406#228406">answered here</a></li>
  <li><del>How would I do the reverse of number 3 with a rule that would work on any site to force the site not to use www, ie redirect to site.com from www.site.com? </del><a href="https://serverfault.com/questions/190589/how-to-redirect-non-www-to-www-without-hardcoding-using-htaccess/228406#228406">answered here</a></li>
  </ol>