如何使用 .htaccess 对 http 和 https 仅提示一次？
我使用 .htaccess 来保护 http://www.domain.com 网站。安全页面重定向到 https://www.domain.com，并再次收到 apache 登录提示。
我们如何才能只有 1 个 http 和 https 的 apache 登录提示？
非常感谢。
I'm using .htaccess to protect a website at http://www.domain.com. Secure pages redirect to https://www.domain.com, and get the apache login prompt again.
How can we have only 1 apache login prompt for both http and https?
Thank you very much.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
你不能。就浏览器而言，http: 和 https: 是两个不同的网站，您无法让浏览器告诉 https: 网站用户为 http: 网站输入了哪个密码。一般来说，这样做会是一个严重的安全漏洞，而且 HTTP 身份验证协议还不够先进，无法让 http: 服务器告诉浏览器“可以对某某站点重复此密码”。 （为什么你会相信一个仅仅 http: 站点给你的安全例外？）
你为什么不通过 https 来做所有的事情呢？
或者，换句话来说，为什么要做任何需要通过纯 HTTP 进行身份验证的事情？这不太安全。如果您在 https 网站上有一些值得 https 安全保护的内容，攻击者就可以从不安全的 http 连接中嗅探密码。
You can't. As far as the browser is concerned, http: and https: are two different websites, and you won't get it to tell the https: site which password the user entered for the http: site. Doing so would be a serious security bug in general, and the HTTP authentication protocol is not advanced enough to allow the http: server to tell the browser, "it is OK to repeat this password for such-and-such site". (And why would you trust a security exception given to you by a mere http: site anyway?)
Why don't you just do everything over https?
Or, put differently, why do you do anything that requires authentication over plain HTTP? That's not very secure. And if you have something on the https site that deserves https security, an attacker could just sniff the passwords from the insecure http connections.