blocks|key|1958151|text|HTTPS使用的SSL或TLS会话是在发送任何HTTP流量之前构建的。这包括认证验证。一旦建立了会话，HTTP流量就会经过它，从GET/POST/任何东西开始，然后服务器会像往常一样用触发登录框的WWW-Authenticate头进行响应。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1958152|至于从HTTP重定向到HTTPS，这取决于您使用的服务器。由于它被标记为.htaccess，因此我将假定Apache，因此，.htaccess文件中的以下内容应该可以做到：|1958153|RewriteEngine+On
RewriteCond+%25{HTTPS}+off
RewriteRule+(.*)+https://%25{HTTP_HOST}%25{REQUEST_URI}|code-block|syntax|javascript|1958154|entityMap^0|2Q|G|0|10|9|1Q|9|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|R|8|@$9|S|A|T|B|C]|$9|U|A|V|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|W|8|@]|D|@]|E|$K|L]]|$1|M|3|-4|5|6|7|X|8|@]|D|@]|E|$]]]|N|$]]

The SSL or TLS session that HTTPS uses gets built before any HTTP traffic gets sent. This includes certification verification. Once the session is built, then HTTP traffic goes over it, starting with the GET/POST/whatever, then the server responds as normal, with the <code>WWW-Authenticate</code> header that triggers the login box.

As for redirecting to HTTPS from HTTP, that depends on what server you're using. Since it's tagged <code>.htaccess</code>, I'm going to assume Apache, for that, something like this in the <code>.htaccess</code> file should do it:

<pre><code>RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</code></pre>

blocks|key|1808027|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1808028|当我通过https与域通信时，它要求我进行身份验证，它验证了证书还是在我通过身份验证后进行了验证？|blockquote|1808029|1808030|1808031|SSL是一个独立于HTTP协议的层，基本身份验证是HTTP协议的一部分。SSL握手首先发生在发送任何协议信息之前。根据进行握手的端点以及它们如何验证彼此的证书，它可能根本不进行任何验证。但是，如果它确实发生了(可能所有广泛使用的浏览器都是这样)，那么它就发生在握手期间，在发送任何身份验证数据之前。|1808032|类似地，如果我通过|1808033|连接，有没有一种简单的方法可以将请求转发到https，然后进行身份验证？|1808034|1808035|1808036|有几种方法可以做到这一点。在StackOverflow上有很多问题询问如何做到这一点，搜索"force+https“。这可能会归结为您有权访问哪些配置文件。如果您可以访问您的vhost配置，则在vhost中为非SSL配置添加Redirect指令，并重定向到https。否则，您将需要在.htaccess文件中执行此操作。类似的内容(在您的非SSL站点中)：|offset|length|style|CODE|1808037|Redirect+301+/+https://yourdomain.com/|code-block|syntax|javascript|1808038|entityMap^0|0|0|0|0|0|0|0|0|0|34|8|0|0^^$0|@$1|2|3|-4|4|5|6|10|7|@]|8|@]|9|$]]|$1|A|3|B|4|C|6|11|7|@]|8|@]|9|$]]|$1|D|3|-4|4|5|6|12|7|@]|8|@]|9|$]]|$1|E|3|-4|4|5|6|13|7|@]|8|@]|9|$]]|$1|F|3|G|4|5|6|14|7|@]|8|@]|9|$]]|$1|H|3|I|4|5|6|15|7|@]|8|@]|9|$]]|$1|J|3|K|4|C|6|16|7|@]|8|@]|9|$]]|$1|L|3|-4|4|5|6|17|7|@]|8|@]|9|$]]|$1|M|3|-4|4|5|6|18|7|@]|8|@]|9|$]]|$1|N|3|O|4|5|6|19|7|@$P|1A|Q|1B|R|S]]|8|@]|9|$]]|$1|T|3|U|4|V|6|1C|7|@]|8|@]|9|$W|X]]|$1|Y|3|-4|4|5|6|1D|7|@]|8|@]|9|$]]]|Z|$]]

<blockquote>
 When I communicate with the domain over https and it asks me to authenticate, has it verified the certificate or does it verify after I've authenticated?
</blockquote>

SSL is a separate layer from the HTTP protocol, BASIC authentication is part of the HTTP protocol. The SSL handshake happens first before any protocol information is sent. Depending on the endpoints doing the handshake and how they go about verifying each other's certificate, it may not do any verification at all. But if it does happen (and probably all widely used browsers do), it happens during the handshake, before any authentication data is sent.

<blockquote>
 Similarly, if I connect over http, is there a simple way to forward to request to https and then authenticate?
</blockquote>

There's several ways to do this. There's a lot of questions on StackOverflow asking how to do this, search for "force https". It's probably going to come down to which config files you have access to. If you have access to your vhost config, then add a <code>Redirect</code> directive in the vhost for the non-SSL config and redirect to https. Otherwise you'll need to do this in an .htaccess file. Something along the lines of this (in your non-SSL site):

<pre><code>Redirect 301 / https://yourdomain.com/
</code></pre>

So, I have an SSL certificate for secure.domain.com. I run a few admin web applications on this domain (git repo etc), authenticated using .htaccess basic auth.

When I communicate with the domain over https and it asks me to authenticate, has it verified the certificate or does it verify after I've authenticated?

Similarly, if I connect over http, is there a simple way to forward to request to https and then authenticate?

HTTP basic auth over SSL

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

因此，我有一个用于secure.domain.com的SSL证书。我在这个域上运行一些管理web应用程序(git repo等)，使用.htaccess basic身份验证。当我通过https与域通信时，它要求我进行身份验证，它是验证了证书还是在我进行身份验证后进行了验证？类似地，如果我通过http连接，有没有一种简单的...

问基于SSL的HTTP基本身份验证
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问基于SSL的HTTP基本身份验证EN