4

I see tons of .htaccess examples containing the [NC] flag (NoCase = case-insensitive)

For example the famous h5bp page uses the [NC] flag a lot:
https://github.com/h5bp/server-configs-apache/blob/master/dist/.htaccess

Nearly every example puts the [NC] flag at the end of the RewriteCond directive.
But the Official documentation clearly states it is used only for the RewriteRule directive.

Are 99% of the examples wrong ?
Is the official documentation wrong or incomplete ?

5

But the Official documentation clearly states it is used only for the RewriteRule directive.

The docs don't say that it can only be used on the RewriteRule directive. The page you link to (which incidentally is specifically about the RewriteRule flags) simply states:

Use of the [NC] flag causes the RewriteRule to be matched in a case-insensitive manner.

The docs for the RewriteCond directive include a section on the flags that can be used with this directive. And these include NC, OR and NV. The NC flag is common to both directives.

If you did use an invalid flag on the RewriteCond directive you'll get a 500 Internal Server error. And if you examine the server's error log you should see something about "invalid flags".

However, (bit of an aside), the NC flag is generally used too much. People often include it by default, when it really isn't necessary (or worse, will actually cause problems).


UPDATE: I'm not sure if the linked document has been updated in the last few years, but there are just 3 cases of the NC flag being used with the RewriteCond directive. The first 2 are certainly justified, the 3rd is debatable IMO.

#376   RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]

When resolving the hostname (value of the Host header) it should always be compared case-insensitively (according to the HTTP spec). All mainstream browsers lowercase the Host header when making the request. However, other user-agents (and bots) may not and mod_rewrite will naturally compare this case-sensitively by default. That doesn't necessarily mean you should always use the NC flag as it does depend on exactly what it is you are doing.

However, the NC flag is justified here since the goal of this rule is to remove the www subdomain, whether that is www, wWw or WWW. Without the NC flag, a (malicious) user-agent could send WWW.EXAMPLE.COM and circumvent the canonical redirect to the domain apex.

#408   RewriteCond %{HTTP_HOST} !^www\. [NC]

Note that this is a negated regex (denoted by the ! prefix). The goal of this rule is to redirect from the domain apex to the www subdomain. The NC flag is justified here, since you want to prevent the redirect when the Host header starts with www or WWW etc. Otherwise you could potentially get a malformed redirect like www.WWW.example.com.

#564   RewriteCond %{REQUEST_URI} "!(^|/)\.well-known/([^./]+./?)+$" [NC]

The use of the NC flag here is debatable IMO. The goal of this rule block is to block access to dot-files and directories, except the .well-known directory. At best it's probably superfluous, however, it does contradict similar conditions used earlier in the file (lines #345-7) that do not use the NC flag.

The .well-known directory should always be lowercase. So, the NC flag should be superfluous. However, by including the NC flag here we end up allowing (not blocking) requests of the form .WELL-KNOWN - which are likely to fail anyway given that we are probably on Linux, which is case-sensitive.

  • you know a lot about htaccess directives, know any places for learning the rewrite syntax? I find httpd.apache.org annoying to use, its all scattered and doesn't show good examples with complex rewrites. – Simon Hayter Aug 30 '15 at 14:37
  • 1
    @SimonHayter Well, I don't really have any magic resources for learning this stuff unfortunately. A lot of trial & error, testing and questioning everything. Although the Apache docs are perhaps too concise in many areas, with few examples, I do find them an invaluable reference. Complex rewrites often involve complex regex, which the Apache docs don't cover at all. regular-expressions.info is my goto resource for regex, although navigation can be a bit tricky as well. askapache.com is a great resource with loads of code snippets and raw examples but little explanation. – MrWhite Aug 30 '15 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.