Mod Rewrite and Redirecting directories - apache

Question

A little explanation and then 2 questions....
Essentially I am building a single page app to display media (by tags, by type, etc.. etc..). All the media is uploaded & tagged by me, so I am not scrapping for content or relying on 3rd party services (twitter, facebook, flickr, imgur, etc...). I am doing most of the work with JS (RequireJS modules...) and am leveraging ToroPHP for a simple, lightweight & restful API
My end goal is this:
Allow returning users to type in URLs like: / OR //, and always load my root index.php (maintaining the url). At the same time i need several subdirectories available for the api to
fetch data:
/assets/ (CSS, Font Files, Sprites or SVG Icons)
/components/ (for RequireJS scripts)
/api/ (this is just a sub directory that has a ToroPHP instance for the API)
I believe the below snippet solves this issue (I was wondering if I could get a good explanation of what this is doing though? I have pieced it together from snippets on the internet):
RewriteEngine on
RewriteRule ^/?assets/.+$ - [L]
RewriteRule ^/?components/.+$ - [L]
RewriteRule ^/?api/.+$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond $1 !^(index\.php)
RewriteRule ^(.*)$ /index.php [L]
Additionally, I was hoping you could help me figure out a way to only allow my "app" (that is, internal calls (is there a server user on apache?) initiated by RequireJS modules to the API) to have access to /assets/ & /components/ & /api/ so if a user types in /api/test?subject=123 they are routed to a page that isn't the index.php, but isn't the actual API either. I would like this to be the same for /components/ & /assets/ as well.
*Summary questions:
1). Help explain the code snippet above.
2). Can I allow my server access to /assets/ & /components/ & /api/ but not allow a user to type into them?
Obviously, Apache isn't my specialty, but I am fairly confident in learning.
Thanks!

Answer 1

Help explain the code snippet above.
RewriteEngine on
Turns on the rewrite engine, none of the rules will do anything unless the rewrite engine is turned on
RewriteRule ^/?assets/.+$ - [L]
RewriteRule ^/?components/.+$ - [L]
RewriteRule ^/?api/.+$ - [L]
These rules are called "pass-through" rules. The - target means "do nothing" and the L flag stops the rewriting for the current pass. These essentially just mean: if URI starts with /assets/, do nothing and stop rewriting. If the URI starts with /components/, do nothing and stop rewriting. If the URI starts with /api/ then do nothing and stop rewriting.
The next rule has a few conditions associated with it. The rule won't get applied unless all conditions are met:
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
These check if the requested URI maps to an existing file or directory, The !-f means the request isn't for a file, and the !-d means the request isn't a directory.
RewriteCond $1 !^(index\.php)
This checks if the request doesn't start with /index.php.
Finally, if all 3 conditions are met, then:
RewriteRule ^(.*)$ /index.php [L]
rewrite whatever the request is to /index.php, and stop rewriting.
Can I allow my server access to /assets/ & /components/ & /api/ but not allow a user to type into them?
No. If someone goes to your page and your page links to something in one of these directories, the browser loads it just like it would if someone typed it into the URL address bar. The only difference is that (sometimes) the browser will include a "Referer" header request letting the server know what page told the browser to load the file. It's not always going to be used by all browsers and it can easily be forged. So checking the referer isn't going to guarantee that people can't still directly load your files.
In order to check the referer, add this right below the RewriteEngine On line:
RewriteCond %{HTTP_REFERER} !^https?://example.com/
RewriteRule ^(assets|components|api)/ - [L,F]
This is essentially a condition that checks the referer, and if it doesn't start with "http://example.com" or "https://example.com", assuming that "example.com" is your site, then the rule checks that the request starts with either /assets/, /components/, or /api/, and passes it through without changing anything, except the F flag causes the server to return a 403 Forbidden.