How to apply RewriteRule properly on forbidden files?

Question

The goal

If the request is http://⋯/.htaccess,
do not display the content of that file,
show an ErrorDocument 403 instead,
rewriting only http:// to https://.

The problem

The URL is rewritten to https://⋯/403.shtml,
instead of the desired https://⋯/.htaccess.

The details

The ErrorDocument 403 and the protection of the
.htaccess are set up by the web hosting provider.

The HTTPS rewrite is set up in the .htaccess file:

RewriteEngine on
RewriteCond %{HTTPS} !on
RewriteRule .* https://%{HTTP_HOST}/$0 [L,QSA,R=301]

Answer 1

Set the following in your .htaccess file to reset the default 403 Apache ErrorDocument:

ErrorDocument 403 default

The ErrorDocument 403 and the protection of the .htaccess are set up by the web hosting provider.

It looks like the host has configured the ErrorDocument directive with an absolute URL to the 403.shtml document, which will naturally trigger a 302 redirect instead of an internal subrequest.

Answer 2

<If "%{HTTPS} != 'on'">
    Require all granted
    RewriteEngine on    
    RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,QSA,R=301]
</If>