I want visitors to my site who visit http://www.domain.com/user/xyz.php to be redirected to https://www.domain.com/user/xyz.php.
ie. if they are anywhere inside /user/ they're in the secure location. so must be redirected to https
My question is not specifically how to achieve this but which method is better?
My gut feeling says I should use a .htaccess Rewrite rule but I also considered something like:
<?php if (!$_SERVER['HTTPS'] && strstr('user', $_SERVER['REQUEST_URI'])){ header('location:https://'.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']); } I'd like to hear opinions on efficiency and security as well as other considerations.
.htaccesswill be more efficient since it is internally redirecting the user and responding with the redirected request. Doing it the php method means php needs to be run and respond with that header and browser has to make another request. And php could maybe fail. But then so could your server. IOW there's more moving parts doing it the php way. Having said that.. doing it the php way gives you more control over injecting new requirements