Rewrite to https causing apache recursion error with junk url - regex

Question

I have the following code on my website in .htaccess to rewrite all requests to .https
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
This generally works just fine. Now for the problem. If I submit a junk url, say domain.com/../../../../etc/psswd, modsecurity does its thing and issues a 403 error code. Also in the same .htaccess I have several ErrorDocument directives, including one for 403. The issue though is that, particularly when I use an iPad or iPhone but my laptop will do it too sometimes, the browser will display (for the above junk url), a 403 error and an additional statement that there was a 500 error while trying to use an ErrorDocument.
The apache error_log provides the following error: 'Request exceeded the limit of 10 internal redirects due to probable configuration error.'
If I comment out the above two RewriteRules in .htaccess the problem goes away, but then I am not redirecting to https. The frustrating bit is that this does not seem to happen all the time. I believe this is happening because my two rewrites to https are catching these junk urls in a recursion loop, I am just at a loss as to how to fix it and maintain my rewrites to https.

Answer 1

Have both of your rules like this with an additional condition:
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
And make sure these rules are right on top before all other rules.
New condition %{ENV:REDIRECT_STATUS} ^$ will skip these 2 rules after ErrorDocument directive has triggered.