htaccess url with regex to forbidden - .htaccess

I need to block all request made with a specific url like
http://www.domain.est/-p-.html?slave_id=15265&osCsid=6j0ltvo8d9i8h30koahqusvua7
I tried with
RewriteCond %{THE_REQUEST} /(\/-p-\.html)+(\?slave_id\=\d{1,6})?(\&osCsid\=\w{1,26})? [NC]
RewriteRule ^ - [F]
but doesn't work.
Where I'm wrong ?
Thanks

This is a version that is easier to handle and should be more robust too:
RewriteEngine on
RewriteCond %{REQUEST_URI} ^/-p-\.html$ [NC]
RewriteCond %{QUERY_STRING} slave_id=[0-9]{1,6}
RewriteCond %{QUERY_STRING} osCsid=[0-9a-z]{1,26}
RewriteRule ^ - [F]
Note: the query args matching patterns are not absolutely precise, but should be robust enough for almost all situations...
For this to work the http servers rewrite module has to be enabled, obviously. The rules will work in the http servers host configuration or in dynamic configurtation files (.htaccess). In case you decide to use such a dynamic configuration file you also have to take care to enable the interpretation of such files with the AllowOverride directive in the host configuration and the file has to be located in your http hosts configured DocumentRoot folder.
And a general hint: you should always prefer to place such rules inside the http servers host configuration instead of using dynamic configuration files (".htaccess"). Those files are notoriously error prone, hard to debug and they really slow down the server. They are only provided as a last option for situations where you do not have control over the host configuration (read: really cheap hosting service providers) or if you have an application that relies on writing its own rewrite rules (which is an obvious security nightmare).

Related

need redirection 301 .htaccess

What Code do i use on .htaccess file to redirect 301 these domains:
https://example.com/* -> https://www.example.com/* -> https://ww.example.com/* -> https://wvw.example.com/* = to https://ww1.example.com/*
thanks in advance for any help.
Well, you need a redirection rule and one condition per host name:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^example\.com$ [OR]
RewriteCond %{HTTP_HOST} ^ww\.example\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com$
RewriteRule ^ https://ww1.example.com%{REQUEST_URI} [QSA,R=301]
If you actually want to redirect all requested hosts your http server responds to over to "ww1.example.com" then this can be simplified:
RewriteEngine on
RewriteCond %{HTTP_HOST} !^ww1\.example\.com$
RewriteRule ^ https://ww1.example.com%{REQUEST_URI} [QSA,R=301]
Here is the documentation, it helps a lot to actually read the documentation of the tool you use:
https://httpd.apache.org/docs/current/mod/mod_rewrite.html
It is a good idea to start out with a 302 temporary redirection and only change that to a 301 permanent redirection later, once you are certain everything is correctly set up. That prevents caching issues while trying things out...
This implementation will work likewise in the http servers host configuration or inside a distributed configuration file (".htaccess" file). Obviously the rewriting module needs to be loaded inside the http server and enabled in the http host. In case you use a distributed configuration file you need to take care that it's interpretation is enabled at all in the host configuration and that it is located in the host's DOCUMENT_ROOT folder.
And a general remark: you should always prefer to place such rules in the http servers host configuration instead of using distributed configuration files (".htaccess"). Those distributed configuration files add complexity, are often a cause of unexpected behavior, hard to debug and they really slow down the http server. They are only provided as a last option for situations where you do not have access to the real http servers host configuration (read: really cheap service providers) or for applications insisting on writing their own rules (which is an obvious security nightmare).

Mod-rewrite rule which just gets the part of the URL after the =

I'm currently trying to redirect this URL
http://dev.example.org/active/researchers/contact.php?IDENT=12345
to
http://portaldev.example.org/users/ident/12345
in htaccess.
However, I can only get a redirect to
http://portaldev.example.org/users/ident/IDENT=12345
because I can't find a way to get rid of the IDENT=. How can I do that?
The rewrite conditions in my htaccess are:
RewriteCond %{REQUEST_URI} ^/active/researchers/contact\.php$
RewriteCond %{QUERY_STRING} ^IDENT=([0-9]*)$
RewriteRule ^(.*)$ http://portaldev.example.org/users/ident/$2 [R=302,NC,L]
This probably is what you are looking for:
RewriteEngine on
RewriteCond %{QUERY_STRING} (?:^|&)IDENT=(\d+)(?:&|$)
RewriteRule ^/?active/researchers/contact\.php$ http://portaldev.example.org/users/ident/%1 [R=302,QSD,NC]
It is a good idea to start out with a 302 temporary redirection and only change that to a 301 permanent redirection later, once you are certain everything is correctly set up. That prevents caching issues while trying things out...
This implementation will work likewise in the http servers host configuration or inside a distributed configuration file (".htaccess" file). Obviously the rewriting module needs to be loaded inside the http server and enabled in the http host. In case you use a distributed configuration file you need to take care that it's interpretation is enabled at all in the host configuration and that it is located in the host's DOCUMENT_ROOT folder.
And a general remark: you should always prefer to place such rules in the http servers host configuration instead of using distributed configuration files (".htaccess"). Those distributed configuration files add complexity, are often a cause of unexpected behavior, hard to debug and they really slow down the http server. They are only provided as a last option for situations where you do not have access to the real http servers host configuration (read: really cheap service providers) or for applications insisting on writing their own rules (which is an obvious security nightmare).
Got the answer to my question for anyone else who needs help:
RewriteCond %{REQUEST_URI} ^/active/researchers/contact\.php$
RewriteCond %{QUERY_STRING} ^IDENT=(.*)
RewriteRule (.*) http://portaldev.cepr.org/users/ident/%1? [R=301,L]
I think the main thing was the ? at the end of the rewrite rule but it also wouldn't work unless I put in the first RewriteCond to request uri and used (.*) in the rewrite rule

.htaccess Rewrite rule not working on Safari

I am trying to redirect a URL xyz.de to www.xyz.de. For that I am utilizing .htaccess but it doesn't work in Safari and Firefox.
Here's what I am doing.
RewriteCond %{http_host} ^xyz.de [nc]
RewriteRule ^(.*)$ http://www.xyz.de/$1 [r=301,nc]
This should do what you are looking for:
RewriteCond %{HTTP_HOST} ^example\.com$
RewriteRule ^/?(.*)$ https://www.example.com/$1 [R=301]
Note that %{http_host} and %{HTTP_HOST} are something different...
It is a good idea to start out with a 302 temporary redirection and only change that to a 301 permanent redirection later, once you are certain everything is correctly set up. That prevents caching issues while trying things out...
This implementation will work likewise in the http servers host configuration or inside a dynamic configuration file (".htaccess" file). Obviously the rewriting module needs to be loaded inside the http server and enabled in the http host. In case you use a dynamic configuration file you need to take care that it's interpretation is enabled at all in the host configuration and that it is located in the host's DOCUMENT_ROOT folder.
And a general remark: you should always prefer to place such rules in the http servers host configuration instead of using dynamic configuration files (".htaccess"). Those dynamic configuration files add complexity, are often a cause of unexpected behavior, hard to debug and they really slow down the http server. They are only provided as a last option for situations where you do not have access to the real http servers host configuration (read: really cheap service providers) or for applications insisting on writing their own rules (which is an obvious security nightmare).

using htaccess rewrite dynamic urls & category url

I want to know how to match a dynamic URL to a static URL using htaccess. but its's work from one RewriteRule but it doesn't work with second RewriteRule. How can i fix this.
I want it like this
contact.php to example.com/contact
category.php?url=some-url to example.com/some-url
My htaccess file
<Files .htaccess>
order allow,deny
</Files>
Options -Indexes
Options +FollowSymLinks -MultiViews
RewriteEngine On
RewriteRule ^([^/]*)$ category.php?url=$1 [NC,L]
RewriteRule ^([^\.]+)$ $1.php [NC,L]
There are a number of issues with your approach. Most important: you appear to have understood the logic of rewriting rules the wrong way round...
Here is an example to get you started, you probably with have to adapt it to your specific setup:
RewriteEngine on
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteRule ^/?(.+)$ $1.php [END]
RewriteCond %{QUERY_STRING} (?:^|&)url=(.+)(?:&|$)
RewriteRule ^/?category\.php$ /%1 [END]
In case you receive an internal server error (http status 500) using the rule above then chances are that you operate a very old version of the apache http server. You will see a definite hint to an unsupported [END] flag in your http servers error log file in that case. You can either try to upgrade or use the older [L] flag, it probably will work the same in this situation, though that depends a bit on your setup.
This rule will work likewise in the http servers host configuration or inside a dynamic configuration file (".htaccess" file). Obviously the rewriting module needs to be loaded inside the http server and enabled in the http host. In case you use a dynamic configuration file you need to take care that it's interpretation is enabled at all in the host configuration and that it is located in the host's DOCUMENT_ROOT folder.
And a general remark: you should always prefer to place such rules in the http servers host configuration instead of using dynamic configuration files (".htaccess"). Those dynamic configuration files add complexity, are often a cause of unexpected behavior, hard to debug and they really slow down the http server. They are only provided as a last option for situations where you do not have access to the real http servers host configuration (read: really cheap service providers) or for applications insisting on writing their own rules (which is an obvious security nightmare).

Htaccess : Redirect url with get parameters

How can i redirect url with get parameters to a regular url :
from
/index.php?cid=100&id=550&Itemid=1084
to
/my-page
I tried :
Redirect 301 /index.php?cid=100&id=550&Itemid=1084 /my-page
but i didnt work
If, as you claim in your comment above, do not need the query arguments in the target request, you can do a simple redirection:
RewriteEngine on
RewriteCond %{QUERY_STRING} ^cid=100&id=550&Itemid=1084$
RewriteRule ^/?index.php$ /my-page [R=301]
That rule will work in the http servers host configuration and likewise in a dynamic configuration file (.htaccess style file).
If you want the matching pattern to be somewhat more flexible, so to accept arbitrary numbers, not just exactly those you specified in the question, then you can use a slightly modified condition:
RewriteEngine on
RewriteCond %{QUERY_STRING} ^cid=\d+&id=\d+&Itemid=\d+$
RewriteRule ^/?index.php$ /my-page [R=301]
And a general hint: you should always prefer to place such rules inside the http servers (virtual) host configuration instead of using dynamic configuration files (.htaccess style files). Those files are notoriously error prone, hard to debug and they really slow down the server. They are only provided as a last option for situations where you do not have control over the host configuration (read: really cheap hosting service providers) or if you have an application that relies on writing its own rewrite rules (which is an obvious security nightmare).

Resources