Unfortunately, PHP code in many known packages (such as Moodle) sometimes relies on the wrong assumption:

$HTTPS = isset($HTTP_SERVER_VARS['HTTPS']) ? $HTTP_SERVER_VARS['HTTPS'] : 'off';

Because in Apache HTTPS variable is never submitted at all in http mode and coders believe this is enough information to check. So, is there a way to never submit HTTPS=off at all if HTTPS is not present?

Andrejs