title: Cyclic redirection in htaccess: HTTPS -> HTTP rule is ignored
body: <p><strong>PART I</strong></p>
  
  <p>I have had the following rewrite rules in htaccess file (on an OpehShift server):</p>
  
  <pre><code>RewriteEngine on
  
  # Must NOT be SSL
  RewriteCond %{HTTP:X-Forwarded-Proto} =https
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d [or]
  RewriteCond %{REQUEST_URI} /
  RewriteCond %{REQUEST_URI} !^/user/login
  RewriteCond %{REQUEST_URI} !^/user/register
  RewriteCond %{REQUEST_URI} !^/user/profile
  RewriteCond %{REQUEST_URI} !^/user/captcha
  RewriteRule (.*) http://%{SERVER_NAME}/$1 [last,redirect=permanent]
  
  # MUST be SSL
  RewriteCond %{HTTP:X-Forwarded-Proto} !=https
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} ^/user/login [or]
  RewriteCond %{REQUEST_URI} ^/user/register [or]
  RewriteCond %{REQUEST_URI} ^/user/captcha [or]
  RewriteCond %{REQUEST_URI} ^/user/profile
  RewriteRule (.*) https://%{SERVER_NAME}/$1 [last]
  
  # if a directory or a file exists, use it directly
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  
  # otherwise forward it to index.php
  RewriteRule . index.php
  </code></pre>
  
  <p>The purpose is to have some paths processed via SSL, while all the others should be acessible via plain http. Initially it was a challenge to setup such config, but it was eventually solved - you may find its history on <a href="https://forums.openshift.com/forcing-https-on-certain-urls-with-modrewrite-makes-infinite-redirection" rel="nofollow noreferrer">OpenShift forums</a>.</p>
  
  <p>This worked fine till some moment in past (perhaps some OpenShift update), when it started cyclic looping on https pages: for example, when a user is on his profile page (with <code>https</code>) and clicks a link for a page outside the secure paths it tries to redirect to <code>https</code>, when again and again.</p>
  
  <p>According to the rules, they should change <code>https</code> to <code>http</code> if it's not login, register, profile or captcha pages, but this does not happen anymore. What can be the problem? Thanks in advance.</p>
  
  <p><strong>PART II</strong></p>
  
  <p>Despite the fact that I accepted @anubhava answer (because this seems to be Apache's problem not mine, as he supposed after hours of invaluable debugging), I'm still struggling with the issue, and any further solutions/workarounds are highly welcomed.</p>
  
  <p>Meanwhile the problem is pinpointed down to the following code:</p>
  
  <pre><code>RewriteCond %{HTTP:X-Forwarded-Proto} !https
  RewriteRule ^(.*)$ - [env=ps:https]
  
  RewriteCond %{HTTP:X-Forwarded-Proto} https
  RewriteRule ^(.*)$ - [env=ps:http]
  
  # known public pages
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteCond %{REQUEST_FILENAME} !-d
  RewriteCond %{REQUEST_URI} ^/site/page/about
  RewriteRule (.*) %{ENV:ps}://%{SERVER_NAME}/$1?ps=%{ENV:ps}&amp;step=1 [last,redirect=permanent]
  </code></pre>
  
  <p>Now when I go to the about page, I got the following http headers:</p>
  
  <pre><code>HTTP/1.1 301 Moved Permanently
  Date: Thu, 27 Nov 2014 15:07:27 GMT
  Server: Apache/2.2.15 (Red Hat)
  Location: https://mydomain.rhcloud.com/site/page/about?ps=http&amp;step=1
  Content-Length: 385
  Content-Type: text/html; charset=iso-8859-1
  Accept-Ranges: none
  Keep-Alive: timeout=15, max=99
  Connection: Keep-Alive
  </code></pre>
  
  <p>Please note that <code>Location</code> has <code>https</code> proto, yet <code>ps</code> parameter is outputted as <code>http</code> (as expected). How this can be if both values are taken from <code>ps</code> variable? It looks weird IMHO.</p>
  
  <p>To put it shortly: <strong>redirections from https to http do not work on OpenShift servers</strong>. Despite the rule saying that protocol should be <code>http</code> server sends out <code>https</code> - hence cyclic redirections.</p>
  
  <p><strong>PART III</strong></p>
  
  <p>Perhaps I should mention that the OpenShift site uses HAProxy as a frontend. Its config does not contain any ssl specific settings. But I have found <a href="https://serverfault.com/questions/481801/haproxy-redirects-and-matching-based-off-uri">this related answer</a>, where one may read:</p>
  
  <blockquote>
    <p>Finally you're not going <strong>to be able to actually redirect people away from an HTTPS connection</strong>, this is considered insecure and is <strong>not supported</strong>.</p>
  </blockquote>
  
  <p>So, can it be that HAProxy does always implicitly override protocol to <code>https</code> for redirections made from secured pages? How to workaround this then?</p>