Force https on section of site

Question

Hey all,
I have a site that needs a secure area. Online they are setup with their own SSL certificate and the host has the SSL mod enabled. I am trying to find a way to force the address to use https if the secure area of the site is accessed.
For example:
1. http://site.dev -> no redirect or rewrite
2. http://site.dev/secure -> redirect/rewrite to https://secure.site.dev
3. http://secure.site.dev -> r/r to https://secure.site.dev
4. http://secure.site.dev/* -> r/r to https://secure.site.dev/*
What the above examples currently do:
1. http://site.dev -> http://site.dev (good)
2. http://site.dev/secure -> https://site.dev/secure/
3. http://secure.site.dev -> http://secure.site.dev (But goes to the localhost site [It Works! default page] rather than attempting the unsecured access)
4. No sub folders to try this yet
If I type in https://secure.site.dev it goes right where it is supposed to using the SSL.
Currently I am attempting to do this with two virtual hosts and some rewrite code in the .htaccess file of the secure folder.
-- Vhost Example
<VirtualHost *:80>
          ServerName site.dev
          DocumentRoot /path/to/public/folder/for/vhost
          Redirect /secure/ https://secure.site.dev
</VirtualHost>
<VirtualHost *:443>
          ServerName secure.site.dev
          DocumentRoot /path/to/public/secure/folder/for/vhost
          SSLEngine on
          SSLCertificateFile /path/to/cert/file.crt
          SSLCertificateKeyFile /path/to/key/file.key
</VirtualHost>
-- .htaccess (in public/secure folder)
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule    ^/(.*) https://%{SERVER_NAME}/$1 [R,L]
-- End of examples
Thanks in advance

Answer 1

Hi
I am not sure then what you mean by a Public Website when you are authenticating users ? There is a difference in both and that difference arises from the fact that Public sites could be accessed by any user without any login credentials.
It should be applied only for one section if at all that section deems to be brought under some security access.
I will put an example for the same :
Say a Mobile Service provider has public site and any one can access the same and read through the information on the pages without any authentications but the moment you want to check your personal connection details then you will be prompted for the same.
Even though this is a public site but there are sections that you need to have security enabled for the real users.
In this sort of scenario I would suggest to put the security group for that section alone to be a secured on (not a a Guest access role).
Hope this clarifies and helps
Thanks
Srinath