2

Description:

I've changed with RewriteRules (no redirect) a typical PHP-like URL:

domain.com/script.php?parameter=value

to more friendly one:

domain.com/script/value

But I still can reach the same output using both the first and second URLs.

Problem to solve:

For security purposes and just because "I don't need one of them", I tried to block the first URL with a 403 response code using an [F] flag matching rule. The problem is that it also blocks the second URL.

Question:

Is there any possible way to accomplish this without blocking the second URL? Is my thinking correct - should I ban the first URL?

2

If you are changing an existing URL structure then you will need to redirect the old (ugly) URLs to the new (pretty) URLs, rather than reject them with a 403 response. If it's a brand new site then you could reject them with a 404 (R=404) - preferable to a 403 I think in this instance.

Something like the following (placed before your existing rewrites):

RewriteCond %{THE_REQUEST} \?parameter=([^\ ]*)\ HTTP/
RewriteRule ^script.php$ /script/%1? [R=301,L]

By comparing against THE_REQUEST we can make sure we only redirect HTTP requests (from the client) and not internal rewrites by Apache.

The %1 in the RewriteRule substitution refers to the parenthesised sub pattern in the RewriteCond pattern. Whilst a question mark (?) at the end of the RewriteRule substitution removes the original query string from the request.

  • Code works fine, but I ve changed redirect to 404. Thanks for this tip I see this more particulary useful. Marked as best answer. – Xarvalus Nov 19 '13 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.