Rewrite rules to hide an url - security

i need to hide full path and show shortly:
www.site.com/this/is/path/to/hide/page.php --> www.site.com
Any idea to do it with .htaccess apache and rewrite rules??
EXAMPLE:
If i type www.site.com i want open index.php (in /),
but if i go to /hidden/path i want to open file.php (in hidden/path)
mantaining browser url in www.site.com.
EDIT:
i want to see in the browser bar www.site.com and i want to open page at /this/is/path/to/hide/page.php .
thanks

As I explained in : How does url rewrite works? every rewrite triggers a new call to the rewritten URL. (HTTP 3xx code).
So the client will ask for www.site.com/this/is/path/to/hide/page.php, would be redirected to www.site.com and will be served the index page as a normal user.
There is no way to tell the client to display one URL in the browser bar instead of another, client browser will always make a new request. (Or you could impersonate any site for example)
If you are not against the use of a cookie, or can use environment variable you may be able to do something like :
RewriteRule this/is/path/to/hide/page.php / [co:knowHiddenPath=true]
The environment variable as same syntax with E instead of co.
(See http://httpd.apache.org/docs/2.0/mod/mod_rewrite.html for cookie information)
Your index page should then check this cookie/variable to serve the hidden page or not.
Another solution would be to enable access with password to your file. So even if someone know the URL he would not access the file. Security by obscurity is does not exists.

You can I believe do that with an Alias,
Alias / /this/is/path/to/hide/page.php
This directive needs to be in your <VirtualHost>

This will use mod_rewrite and you can put this into your .htaccess
# Activate Rewrite Engine
RewriteEngine On
# Home page rewrite rule
RewriteRule ^$ /this/is/path/to/hide/page.php [QSA,L]
This will ONLY work if you hit website root (e.g. http://www.example.com/)

Related

Apache .htaccess redirect to an anchor

I'm trying to do a one-off damage-limitation redirection to an anchor on a page on a website. A wrong URL got published in some publicity material, like this:
https://mydomain.org.uk/A/B
when what I really wanted to publish was
https://mydomain.org.uk/A#B
Having looked at some other answers it seems that any redirect with an anchor needs to be an absolute URL. So I put this in my .htaccess:
RewriteRule A/B https://mydomain.org.uk/A.php#B [NE,L]
(note, the .php is correct, A.php is the page file). And it just simply doesn't work. The browser simply loads A.php and displays it from the top.
I know that the rule pattern is matching, because if I make the target be a completely nonexistent page I get a 404 as expected.
Unfortunately my web hosting service doesn't let me use the Apache log, so it's hard to trace what's going wrong. Can anyone guide me to how to do the rewrite properly so that I pass the #anchor all the way through to the user's browser?
Thanks in advance!
When the RewriteRule is processed by the server, it basically changes internally which resource to access, without the browser noticing.
The only way to change the URL in the browser is to use the redirect flag. This will make the webserver send a HTTP 302 response with a Location header, which then will result in the browser changing the URL and requesting the new page. This new URL can contain an anchor.
In your case the following rule should work:
RewriteRule A/B https://mydomain.org.uk/A.php#B [NE,R,L]
Please keep in mind that anchors are a browser feature so they are normally not sent to the server and therefore neither appear in access logs nor can be used in a RewriteRule.

htaccess help needed on redirect in php with "unchanged" url

I have a site where I redirect the user to a url, created within a SQL query based on what he entered. So when someone for instance enters http://www.example.com/Something, they are automatically redirected to something like http://www.example.com/Templates/12ES.html?ID=a_very_long_string&URI=Something.
This is all done in one PHP file, and the ID and URI parameters are dynamic.
Is there a way to keep the URL the user entered in the browser while I let PHP do the redirecting silently?
Thanks.
Assuming the .htaccess file in your project root and you're only expecting a single URL segment you could try something along these lines:
RewriteRule ^(.*) /Templates/12ES.html?ID=a_very_long_string&URI=$1 [L]
So long as you don't set the R flag the address in the browser's address bar wont change.

What to do with dynamic url after rewrite?

After you've been able to successfully create a url rewrite how do you handle the original and other possibly ways to access a page. This of course to prevent duplicate content. For example if I have this:
RewriteEngine on
RewriteBase /
RewriteRule ^blog/(\d+)/([\w\-/\.]+)/?$ blog.php?id=$1&article_title=$2 [L]
I'm able to access the page by the url
https://www.mysite.com/blog/10/mysite.com (the mysite.com is the article title)
The problem is I'm also able to access the site by going to
https://www.mysite.com/blog.php?id=10article_title=sitetitle
https://www.mysite.com/blog.php?id=10
ect.
How are you supposed to handle those particular urls.
Also should I change the blog.php?id=10 to the rewritten url? Can I rely on something else and just start using the full rewritten url now? The site is new.
For my web site, I have the script that gets called from inside the rewrite detect the URI they were fetched from (using the "REQUEST_URI" variable that at least Apache sets), and redirect to the canonical one if they ever get called with the internal one (outputting a 301 direction).

.htaccess invisible redirect to page within subfolder

I've tried many options in .htaccess without success. What I want to do is this:
I have Wordpress residing in its own folder, like this: site.com/folder
I want all users visiting site.com to be redirected to site.com/folder/page but in such a way that the URL doesn't change in the browser. All other URLs, such as site.com/folder and site.com/folder/page1 etc shouldn't be affected.
How to do this, in as SEO-friendly way as possible?
Thanks everyone.
You can't redirect a user to a other page from serverside without to show this to the use.
But if you need, you can use the HTML tag <frame> http://www.w3schools.com/tags/tag_frame.asp
But the bad side with this is the use always will be show "site.com" and not the real page.
But I think the best way is to proxy the result, in Apache you can do this by something like this.
RewriteEngine ON
RewriteRule ^/$ folder/page/index.php [L]

Rewrite all requests from a single directory to a script - .htaccess

I need change files url in one folder in my server. It should prevent from direct download but I don't need deny from all rule.
Example:
typical direct link:
http://www.domain.com/foder1/folder2/file.ext
and I need this:
http://www.domain.com/page.html?file=foder1/folder2/file.ext
so in my case I need add this string (page.html?file=) to url. Maybe I'm wrong But I think it must be redirect becouse rewrite not execute page.html just only change (view of) url.
To do this, you need to use mode_rewrite. It will execute the page.html file just fine. It just won't update the URL in the browser bar. So, the user will have no idea they have been directed from the actual file to a script/html page. (As they probably should not!)
Here is an example:
RewriteEngine On
RewriteRule !^foder1/folder2(/|$) page.html?file=%{REQUEST_URI} [L]

Resources