Home

PHP

Determining whether page queried through the HTTPS protocol

Fri, 05/28/2010 - 12:25 — Farzan

Have you ever wondered how you can determine the protocol f current page: HTTP or HTTPS?

There is an index in $_SERVER variable that helps you: $_SERVER['HTTPS'].
PHP manual says: "Set to a non-empty value if the script was queried through the HTTPS protocol". PHP manual adds this as well: "...when using ISAPI with IIS, the value will be off if the request was not made through the HTTPS protocol."
In other words, you need to check it like this:

  1. if (! empty($_SERVER['HTTPS']) and $_SERVER['HTTPS'] != 'off') {
  2.     // It's secure!
  3.     ...
  4. }

I am using this technique for a while and it has worked fine so far. However, somebody here mentioned that this technique does not work sometimes: "if you config your apache base on Name-based (More than one web site per IP address), this solution doesn't work" because "Name-based virtual hosting cannot be used with SSL secure servers because of the nature of the SSL protocol".

I am not aware of any other way to check the protocol. If you know a bullet-proof way to distinguish between HTTP and HTTPS, let me know.

Syndicate content