All geek questions in one place

.htaccess RewriteRule causing 403 ban

I am trying to set up a PHP rewrite infrastructure on my webhost (Dreamhost). It includes the following .htaccess:

Options FollowSymLinks RewriteEngine On RewriteRule ^([^.]+)$ $1.html [QSA] RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)$ bootstrap.php [QSA,L]

This works fine on my machine (XAMPP 1.7.7 on Windows 7), but results in 403 Prohibited Errors in some files of my web host. All permissions to access the directory are set to 755, and all permissions for files are set to 644. PHP runs under the same user who owns the files.

The following URLs result in 403s:

  • http://test.dd.moofz.com/
  • http://test.dd.moofz.com/recess-conf.php
  • http://test.dd.moofz.com/index.php
  • http://test.dd.moofz.com/bootstrap.php
  • http://test.dd.moofz.com/MIT-LICENSE

The following URLs:

  • http://test.dd.moofz.com/.gitignore
  • http://test.dd.moofz.com/httpd_logo_wide.gif
  • http://test.dd.moofz.com/README.textile
  • http://test.dd.moofz.com/the-book-of-recess.pdf

What can happen?

+6
source share
2 answers

As it turned out, I needed to change the line:

 Options FollowSymLinks

in

 Options +FollowSymLinks
+8
source

Not familiar with this database, but it seems that there are some lines in another place or may need to be configured.

Although I, by all accounts, are not an expert in rewriting mods, it looks like this: the first line directs all requests to request_file.html, and then in line 2, if the file does not exist, it calls boostrap.php in line 3.

Your problem might be boostrap.php, see what happens in this script and how the request is processed. At this point, a debugger may be useful. Although you can make it work, it seems to me that it is not optimal as it is. For example, I believe that there is usually a set of rules that avoids havings.gif, .jpg.css aimed at your routing script. Something like that:

 RewriteCond $1 !^(favicon\.ico|favicon\.png|media|robots\.txt|crossdomain\.xml|css|js)

This avoids the overhead of php processing requests for these file types. There would be even more things to consider when using a reliable application, just adjust your rules so that everything is directed correctly and everything should be fine.

+2
source

Source: https://habr.com/ru/post/912714/

More articles:


All Articles