mod_rewrite And Friends

• Preface
  • Who This Book Is For
  • How To Read This Book
  • A Note on Versions
  • Errata and Feedback
  • Acknowledgments

Contents

• 1. Regular Expressions
  • 1.1. The Building Blocks
  • 1.2. Matching anything
  • 1.3. Escaping characters
  • 1.4. Anchoring text
  • 1.5. Matching one or more characters
  • 1.6. Matching zero or more characters
  • 1.7. Repetition quantifiers
  • 1.8. Greedy Matching
  • 1.9. Making a match optional
  • 1.10. Grouping and capturing
  • 1.11. Backreferences
  • 1.12. Character Classes
  • 1.13. Negation
  • 1.14. Regex examples
    • 1.14.1. Email address
    • 1.14.2. Phone number
    • 1.14.3. Matching URIs
    • 1.14.4. Matching the homepage
    • 1.14.5. Matching a directory
    • 1.14.6. Matching a filetype
  • 1.15. Regex tools
    • 1.15.1. Online tools
    • 1.15.2. Command-line tools
    • 1.15.3. Learning resources
  • 1.16. RewriteRule generators
  • 1.17. Summary
• 2. URL Mapping
  • 2.1. mod_rewrite
  • 2.2. DocumentRoot
  • 2.3. DirectoryIndex
  • 2.4. FallbackResource
  • 2.5. Automatic directory listings
  • 2.6. Alias
  • 2.7. AliasMatch and ScriptAliasMatch
  • 2.8. Redirect
  • 2.9. RedirectMatch
  • 2.10. Location
    • 2.10.1. Virtual Hosts
  • 2.11. mod_vhost_alias
    • 2.11.1. Proxying
  • 2.12. mod_proxy_express
    • 2.12.1. mod_actions
    • 2.12.2. mod_imagemap
    • 2.12.3. mod_negotiation
    • 2.12.4. mod_userdir
    • 2.12.5. mod_speling
    • 2.12.6. File not found
• 3. Introduction to mod_rewrite
  • 3.1. Where mod_rewrite fits in the request lifecycle
    • 3.1.1. Loading mod_rewrite
    • 3.1.2. RewriteEngine
  • 3.2. How mod_rewrite interacts with other modules
    • 3.2.1. mod_rewrite in .htaccess files
  • 3.3. What are .htaccess files?
  • 3.4. Ok, so, what’s the deal with mod_rewrite in .htaccess files?
  • 3.5. So, what do I do?
    • 3.5.1. RewriteOptions
  • 3.6. Inherit and InheritBefore
  • 3.7. InheritDown and InheritDownBefore
  • 3.8. IgnoreInherit
  • 3.9. AllowNoSlash
  • 3.10. AllowAnyURI
  • 3.11. MergeBase
  • 3.12. IgnoreContextInfo
  • 3.13. LegacyPrefixDocRoot
  • 3.14. LongURLOptimization
    • 3.14.1. RewriteBase
• 4. RewriteRule
  • 4.1. Syntax
  • 4.2. Pattern
    • 4.2.1. Negated patterns
  • 4.3. Target
    • 4.3.1. A file-system path
    • 4.3.2. URL-path
    • 4.3.3. Absolute URL
    • 4.3.4. - (dash)
  • 4.4. Backreferences
    • 4.4.1. Server variables in the target
  • 4.5. Query string handling
  • 4.6. Per-directory context gotchas
  • 4.7. Home directory expansion
  • 4.8. How rules are processed
  • 4.9. Flags at a glance
  • 4.10. Security Considerations
    • 4.10.1. Open Redirects
    • 4.10.2. Server-Side Request Forgery (SSRF)
    • 4.10.3. Path Traversal
    • 4.10.4. General Principles
• 5. Rewrite Logging
  • 5.1. Trace Levels
  • 5.2. Enabling Rewrite Logging
  • 5.3. Per-Directory Logging
  • 5.4. What’s in the Rewrite Log? — An Example
  • 5.5. RewriteRules in .htaccess Files — An Example
  • 5.6. Debugging RewriteMap Lookups
  • 5.7. Common Error Messages
  • 5.8. Don’t Leave It On
• 6. RewriteRule Flags
  • 6.1. B - escape backreferences
  • 6.2. BNP - backrefnoplus
  • 6.3. BCTLS
  • 6.4. BNE
  • 6.5. C - chain
  • 6.6. CO - cookie
    • 6.6.1. Domain
    • 6.6.2. Lifetime
    • 6.6.3. Path
    • 6.6.4. Secure
    • 6.6.5. httponly
    • 6.6.6. Example
  • 6.7. DPI - discardpath
  • 6.8. E - env
  • 6.9. END
  • 6.10. F - forbidden
  • 6.11. G - gone
  • 6.12. H - handler
  • 6.13. L - last
  • 6.14. N - next
  • 6.15. NC - nocase
  • 6.16. NE - noescape
  • 6.17. NS - nosubreq
  • 6.18. P - proxy
  • 6.19. PT - passthrough
  • 6.20. QSA - qsappend
  • 6.21. QSD - qsdiscard
  • 6.22. QSL - qslast
  • 6.23. R - redirect
  • 6.24. S - skip
  • 6.25. T - type
  • 6.26. UnsafeAllow3F
  • 6.27. UnsafePrefixStat
  • 6.28. UNC
• 7. RewriteCond
  • 7.1. TestString
  • 7.2. CondPattern
  • 7.3. Examples
    • 7.3.1. Matching query strings
    • 7.3.2. Hostname-based routing
    • 7.3.3. File and directory existence
    • 7.3.4. Time-based rules
    • 7.3.5. Requiring HTTPS
    • 7.3.6. Combining conditions with OR
• 8. RewriteMap
  • 8.1. Creating a RewriteMap
  • 8.2. Using a RewriteMap
  • 8.3. Default Values
  • 8.4. RewriteMap Types
    • 8.4.1. int
    • 8.4.2. toupper
    • 8.4.3. tolower
    • 8.4.4. escape
    • 8.4.5. unescape
    • 8.4.6. txt
    • 8.4.7. rnd
    • 8.4.8. dbm
    • 8.4.9. prg
    • 8.4.10. dbd
• 9. Proxies and mod_rewrite
  • 9.1. The mod_proxy family
    • 9.1.1. Which modules to load
  • 9.2. When to use [P] vs ProxyPass
  • 9.3. Basic proxying with [P]
  • 9.4. Conditional proxying
  • 9.5. Proxying with RewriteMap
  • 9.6. SSL/TLS considerations
  • 9.7. Rewriting proxied responses
  • 9.8. Common pitfalls
• 10. Virtual hosts and mod_rewrite
  • 10.1. The problem
  • 10.2. Dynamic vhosts with mod_rewrite
    • 10.2.1. Stripping the www. prefix
  • 10.3. Using a map file for vhosts
  • 10.4. Handling aliases and CGI in dynamic vhosts
  • 10.5. Why mod_vhost_alias is usually better
  • 10.6. Per-user virtual hosts
  • 10.7. Logging for dynamic vhosts
• 11. Access control with mod_rewrite
  • 11.1. Forbidding image hotlinking
    • 11.1.1. The non-rewrite alternative
  • 11.2. Blocking specific robots/user agents
    • 11.2.1. The non-rewrite alternative
  • 11.3. Denying by IP address or hostname
    • 11.3.1. The modern alternative
  • 11.4. Referer-based deflection
  • 11.5. Time-based access control
    • 11.5.1. The <If> alternative
  • 11.6. Requiring HTTPS
  • 11.7. Environment variable gating
  • 11.8. When not to use mod_rewrite for access control
• 12. Conditional Configuration
  • 12.1. Introduction
  • 12.2. Match Directives
  • 12.3. IfDefine
  • 12.4. Define
  • 12.5. <If>, <Elsif>, and <Else>
    • 12.5.1. Canonical hostname
    • 12.5.2. Image hotlinking
    • 12.5.3. The expression parser (ap_expr)
  • 12.6. mod_macro
  • 12.7. mod_proxy_express
  • 12.8. mod_vhost_alias
  • 12.9. Conditional logging
    • 12.9.1. env=
    • 12.9.2. Response-code conditional format strings
    • 12.9.3. Per-module logging
    • 12.9.4. Per-directory logging
    • 12.9.5. Piped logging
• 13. Content Munging
  • 13.1. mod_substitute
    • 13.1.1. Basic usage
    • 13.1.2. Handling long lines
    • 13.1.3. Using regular expressions
    • 13.1.4. Content type filtering
  • 13.2. mod_sed
    • 13.2.1. Basic usage
    • 13.2.2. When to reach for mod_sed
  • 13.3. mod_proxy_html
    • 13.3.1. A worked example
    • 13.3.2. Extending to CSS and JavaScript
    • 13.3.3. Setting the output doctype
    • 13.3.4. Comparison with mod_substitute
  • 13.4. Filters
    • 13.4.1. Adding filters to the chain
    • 13.4.2. Filter ordering
    • 13.4.3. Conditional filtering with mod_filter
    • 13.4.4. The escape hatch: mod_ext_filter
    • 13.4.5. Putting it all together
• 14. Recipes
  • 14.1. Common Redirects
    • 14.1.1. Redirecting HTTP to HTTPS
    • 14.1.2. Canonicalizing the Hostname (www vs. non-www)
    • 14.1.3. Adding or Removing Trailing Slashes
    • 14.1.4. Redirecting an Entire Site to a New Domain
    • 14.1.5. Redirecting Individual Pages That Have Moved
    • 14.1.6. Redirecting Wildcard Subdomains
  • 14.2. Clean and Pretty URLs
    • 14.2.1. Removing File Extensions (.php, .html)
    • 14.2.2. Front Controller Pattern (CMS/Framework Routing)
    • 14.2.3. Mapping Clean URL Paths to Query Parameters
  • 14.3. Access Control
    • 14.3.1. Blocking Hotlinking (Referrer-Based Access)
    • 14.3.2. Blocking Requests by User-Agent
    • 14.3.3. Cookie-Based Redirect to Login Page
    • 14.3.4. IP-Based Access Control
  • 14.4. Proxying
    • 14.4.1. Rewriting URLs for a Reverse Proxy Backend
    • 14.4.2. Redirects Behind a TLS-Terminating Proxy
    • 14.4.3. WebSocket Proxying
  • 14.5. Query String Manipulation
    • 14.5.1. Capturing and Rewriting Query Strings
    • 14.5.2. Stripping Query Strings
    • 14.5.3. Using SetEnvIf with Query Strings
  • 14.6. Edge Cases and Gotchas
    • 14.6.1. Diagnosing and Fixing Rewrite Loops
    • 14.6.2. .htaccess vs. Server Config Context Differences
    • 14.6.3. Rule Ordering and the [L] Flag
    • 14.6.4. Debugging Rewrite Rules with the Rewrite Log
    • 14.6.5. Serving a Fallback Resource When a File Is Missing
    • 14.6.6. Maintenance Mode (503 Service Unavailable)
    • 14.6.7. Handling Special Characters and Encoded URLs
    • 14.6.8. Performance with Large Numbers of Redirects
  • 14.7. When NOT to Use mod_rewrite
    • 14.7.1. Simple Redirects: Use Redirect, Not RewriteRule
    • 14.7.2. Proxying: Use ProxyPass, Not RewriteRule [P]
    • 14.7.3. Conditional Logic: Use <If> Expressions
    • 14.7.4. Fallback Resources: Use FallbackResource, Not RewriteRule
    • 14.7.5. Advanced: Using RewriteMap for Dynamic Rewrites
    • 14.7.6. Advanced: IP Range Matching with RewriteMap

Back Matter

• Glossary
• List of Epigraphs
  • Preface
  • Chapter 1: Regular Expressions
  • Chapter 2: URL Mapping
  • Chapter 3: Introduction to mod_rewrite
  • Chapter 4: RewriteRule
  • Chapter 5: Rewrite Logging
  • Chapter 6: RewriteRule Flags
  • Chapter 7: RewriteCond
  • Chapter 8: RewriteMap
  • Chapter 9: Proxies and mod_rewrite
  • Chapter 10: Virtual hosts and mod_rewrite
  • Chapter 11: Access control with mod_rewrite
  • Chapter 12: Conditional Configuration
  • Chapter 13: Content Munging
  • Chapter 14: Recipes