When choosing how to fill that variable, we decided to find a compromise between IIS and Apache.

In the current Apache implementation, when mod_ssl is enable, variable HTTPS is exported and is set to "on".

When mod_ssl is disabled, no such variable is exported.

In IIS, the variable is always exported, and it is set to "on" if the site in on https://, "off" otherwise (http://msdn2.microsoft.com/en-us/library/ms524602.aspx ).

So Abyss Web Server followed IIS' way of doing things which is compatible with Apache's provided that the script checks for $_SERVER['HTTPS'] == "on". Actually Apache documentation states that HTTPS is set to "on" when there is HTTPS but does not say anything regarding the case when the site is on http:// only. So it is wiser to check for what is documented ( $_SERVER['HTTPS'] == "on" ) and not rely on an undocumented feature ( isset($_SERVER['HTTPS']) ). Even in mod_ssl's examples, checking if a server is on http:// is done using:

RewriteCond          %{HTTPS} !=on

(found in http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html ).

By the way with its current code, the script (UNB) will also misbehave on IIS which represents a large share of Web servers out there.

So for the sake of broader compatibility with Web server (IIS and others) and for a strict compliance with Apache documentation, it would be better that the script changes the way it checks for HTTPS .