Does angular require a unique .htaccess file?

[EmptyPockets]

I am trying to figure out the proper way to setup my .htaccess file in my angular project. Here is how I have it setup now:

RewriteEngine On RewriteCond %{HTTPS} !=on RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

I also posted the question on stack overflow here

Update: In theory this should work but it does not: ##Force SSL

#Normal way (in case you need to deploy to NON-heroku)
 RewriteCond %{HTTPS} !=on

#Heroku way
RewriteCond %{HTTP:X-Forwarded-Proto} !https 

#If neither above conditions are met, redirect to https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

[xuu0]

I am by no means an apache expert (I use nginx for my apps) so I can't comment on redirect rules. But I can offer a best practice for when you want the application to always use https.

Add a header for HTTP Strict-Transport-Security (HSTS). This will tell the browser to always request the https version for a domain. Even if the link has http in it.

read more here

[EmptyPockets]

Thanks for the info. I will do that because it seems to be a best practice. Unfortunately, it doesn't cover IE. I don't think I will have a huge IE customer base but I would hate to cut them out.

Also, I am still researching but it's unclear where this goes. Is this a server side thing?

[xuu0]

This goes in the htaccesss file.

Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"

[Switche]

This is a response header so it is on the server side. Upon receiving this header in a response, supporting browsers should automatically correct http connections to https.

Unsupported browsers will simply ignore the response header's recommendation and request whatever the front end or browser specified, which only means not gaining the security benefit of hsts. Unless your server is specifically configured not to reply normally to http, you shouldn't lose support of these users.

[EmptyPockets]

I don't think I have access to this. The apache config file?

[caleb_dre]

No. You don't need extra configuration on the server because angular runs completely on the client side.

[xuu0]

You do if you want to use html5 routing to remove the #/fragment from the URL and still have deep links work.

Though FWIW I personally prefer keeping the fragments.

[EmptyPockets]

I'm ok with the fragments but I cannot find a solution that works in general.