403 error page not working with F flag in .htaccess - apache

I'm trying to only allow https connections to a subdomain of mine. My .htaccess looks like this currently:
Options -MultiViews -Indexes
ErrorDocument 403 /403.php
ErrorDocument 404 /404.php
RewriteEngine On
#Only allow https requests
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !/docs/?(.*)$ [NC]
RewriteRule ^ - [F]
#Docs file rewrite
RewriteRule ^docs/?$ /Docs.php
If I remove the Only allow https requests section and try to access a directory (e.g. http://foo.bar.com/images/), I am displayed my pretty 403 page. But if I leave that section in and go to the subdomain root (e.g. http://foo.bar.com/), I get the default error page, is this something to do with htaccess completely forbidding access to all files?
Examples:
Through a secure connection the 403 page works - https://api.subjectplanner.co.uk/assets
But through a non secure one, it is the default page - http://api.subjectplanner.co.uk/assets

RewriteEngine On should be before you use rewrite rules:
Options -MultiViews -Indexes
ErrorDocument 403 /403.php
ErrorDocument 404 /404.php
RewriteEngine On
#Only allow https requests
RewriteCond %{HTTPS} off
RewriteRule !^docs - [NC,F]
RewriteRule ^docs/?$ /Docs.php [L,NC]

Related

.htaccess rewrite to show only root url and hide everything after /folder

From this URL
www.example.com/error_documents/404
to this URL
www.example.com/404
I've tried many different .htaccess rules but none of them worked.
I'm trying to just hide the /error_pages/ folder section from the URL without any actual redirecting because if I write a correct *RewriteRule, its just keep repeating itself and I get an ERR_TOO_MANY_REDIRECTS error, because if you want to go to an unknown folder, the error document redirects to example.com/error_documents/404 and if I rewrite this to example.com/404, its an unknown folder so it is trying to redirect me to the /error_documents/404 page but the htaccess file keeps redirecting to a forever loop.
Current .htaccess file
RewriteEngine On
RewriteBase /
RewriteCond %{THE_REQUEST} ^[A-Z]{3,}\s/+error_pages/([^\s]+) [NC]
RewriteRule ^ %1 [R=301,L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule (?!^error_pages/)^(.*)$ /error_pages/$1 [L,NC]
This .htaccess gives me forever loop:
www.example.com/unknownfolder
to
www.example.com/error_documents/404
to
www.example.com/404
and this keeps repeating...
I'm using cPanel for ErrorDocuments and the main .htaccess file is:
ErrorDocument 400 http://example.com/error_pages/400
ErrorDocument 401 http://example.com/error_pages/401
ErrorDocument 403 http://example.com/error_pages/403
ErrorDocument 404 http://example.com/error_pages/404
ErrorDocument 503 http://example.com/error_pages/503
Options -Indexes
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
ErrorDocument 400 http://example.com/error_pages/400
ErrorDocument 401 http://example.com/error_pages/401
ErrorDocument 403 http://example.com/error_pages/403
ErrorDocument 404 http://example.com/error_pages/404
ErrorDocument 503 http://example.com/error_pages/503
You shouldn't be using an absolute URL in the ErrorDocument directive in the first place - this is what is causing the external (302) redirect and exposing the location of /error_pages and the error document. Consequently, this also loses information about the request that caused the error.
However, /400 and /401 etc. should reference the actual file(s) that handle the request. eg. /400.html and /401.html etc.
You should be using a root-relative file-path (starting with a slash) to the error document and then Apache will issue an internal subrequest, rather than a redirect.
For example:
ErrorDocument 400 /error_pages/400.html
ErrorDocument 401 /error_pages/401.html
ErrorDocument 403 /error_pages/403.html
ErrorDocument 404 /error_pages/404.html
ErrorDocument 503 /error_pages/503.html
Your /error_pages now remains totally hidden from the end user.
No need to manually try and remove this from the URL (because it should never be present in the URL to begin with). You can (optionally) prevent direct access to the /error_pages directory if you want (careful not to block subrequests for the error documents).
Reference:
https://httpd.apache.org/docs/2.4/mod/core.html#errordocument

htaccess: RewriteRule, Tomcat & 503

Given the following htaccess:
DirectoryIndex
RewriteEngine on
RewriteCond %{HTTPS} !on
RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L,QSA]
RewriteRule ^ http://%{HTTP_HOST}:8080%{REQUEST_URI} [P]
If the Tomcat instance is running under Port 8080, the request will be passed.
If the instance is not running, I'm getting an ugly 503-error.
I was trying to replace it with a custom-made page. This works:
ErrorDocument 503 "offline"
but this doesn't:
ErrorDocument 503 /home/www-data/error/503.html
I'm getting:
Additionally, a 503 Service Unavailable error was encountered while trying to use an ErrorDocument to handle the request.
What is the correct solution?
For ErrorDocument you need to give the path of your html page, relative to the document root. So if the DocumentRoot is /home/www-data/ simply set /error/503.html.
Now if this is a .htaccess present in /home/www-data/ then all documents which are children of this directories get the rules applied. So I think even your /error/503.html is treated by your Proxy directive:
RewriteRule ^ http://%{HTTP_HOST}:8080%{REQUEST_URI} [P]
Would be instead:
RewriteCond %{ENV:REDIRECT_STATUS} !=503
RewriteRule ^ http://%{HTTP_HOST}:8080%{REQUEST_URI} [P]
I think it should be enough, or you can exclude /error from the matching path.

.htaccess url rewrite but nothing happens

Im currently trying to rewrite the urls of my new site by writing im my .htaccess. ive done redirects for 3 different scenarios and a generel.
The urls doesnt get redirect for nice url.
rewriting this url "http://domain.dk/?fag=1&id=87" to: "http://domain.dk/fag/1/id/87"
rewriting this url "http://domain.dk/?fag=1" to: "http://domain.dk/fag/1/"
rewriting this url "http://domain.dk/?id=87" to: "http://domain.dk/id/87"
my code is
Options +FollowSymLinks
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^www\.domain\.dk$ [NC]
ErrorDocument 400 /?fejl=400
ErrorDocument 401 /?fejl=401
ErrorDocument 403 /?fejl=403
ErrorDocument 404 /?fejl=404
ErrorDocument 500 /?fejl=500
RewriteRule fag/(.*)/aflevering/(.*)/ index.php?fag=$1&id=$2
RewriteRule fag/(.*)/ index.php?fag=$1
RewriteRule aflevering/(.*)/ index.php?id=$2
You need the AllowOverride directive set to All for the container

Strange behavior for /index.php/foo

I have a website at http://www.mywebsite.com/~me/ and I want these behaviors:
http://www.mywebsite.com/~me/index.php should redirect to http://www.mywebsite.com/~me/
A URL pointing to something that doesn't exist should redirect to http://www.mywebsite.com/~me/404.php
In looking around for solutions, I found these snippets to include in my httpd.conf file:
Options +FollowSymLinks
DirectoryIndex index.php
RewriteEngine On
RewriteBase /~me/
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /~me/index\.php\ HTTP/
RewriteRule ^index\.php$ http://www.mywebsite.com/~me/ [R=301,L]
and
ErrorDocument 404 /~me/404.php
These snippets create behavior 1 just fine, and for the most part behavior 2 as well. However, instead of http://www.mywebsite.com/~me/index.php/foo redirecting to the 404 page, it redirects to http://www.mywebsite.com/~me/index.php.
How would I change these snippets to get the behavior I want?

Apache mod_rewriting not finding any files

OK, so we have a specific set of rewrites that we use on a number of sites due the file structure of our programming. It's never been a problem before until now.
For example, the rewrite:
RewriteRule ^$ Pages/news.php
Instead of directing to http://www.domain.com/wedding-venues-and-caterers-news/Pages/news.php it is redirecting to /path/to/file/public/wedding-venues-and-caterers-news/Pages/news.php and it's 404-ing (/path/to/file being the actual path).
If anyone could shed any light as to why this is happening, or point me in the right direction then I would be eternally grateful.
I am running all of my script and files in a subfolder, there is another .htaccess file in the root folder which I have edited in at the bottom but it doesn't seem to contain anything that could be interfering.
If you require any further information on the server then let me know!
EDIT - Here are all my rewrites as requested.
Options +FollowSymLinks
Options +Indexes
RewriteEngine On
RewriteRule ^$ Pages/news.php
RewriteRule ^images/([0-9]+)/([0-9]+)/(0|1)/(.*).jpg?$ Classes/Image/timthumb.php?src=http://www.domain.com/wedding-venues-and-caterers-news/images/$4.jpg&h=$1&w=$2&zc=$3
RewriteRule ^([A-Za-z0-9\-]+)/([0-9]+)/([0-9]+)(/)?$ Pages/archives.php?cat_id=$2&page=$3 [NC,L]
RewriteRule ^archives/mon/([0-9]+)/yr/([0-9]+)/([0-9]+)$ Pages/archives.php?mon=$1&yr=$2&page=$3 [NC,L]
RewriteRule ^([A-Za-z0-9\-]+)/([0-9]+)(/)?$ Pages/archives.php?cat_id=$2 [NC,L]
RewriteRule ^archives/mon/([0-9]+)/yr/([0-9]+)(/)?$ Pages/archives.php?mon=$1&yr=$2 [NC,L]
RewriteRule ^([A-Za-z0-9\-]+)/([A-Za-z0-9\-]+)/([0-9]+)(/)?$ Pages/article.php?art_id=$3 [NC,L]
RewriteRule ^wedding-venues-catering-rss(/)?$ rss/rss.php [NC,L]
RewriteRule ^Page-Error(/)?$ Pages/errorPage.php [NC,L]
ErrorDocument 404 http://www.domain.com/wedding-venues-and-caterers-news/Page-Error
ErrorDocument 401 http://www.domain.com/wedding-venues-and-caterers-news/Page-Error
ErrorDocument 403 http://www.domain.com/wedding-venues-and-caterers-news/Page-Error
ErrorDocument 404 http://www.domain.com/wedding-venues-and-caterers-news/Page-Error
ErrorDocument 500 http://www.domain.com/wedding-venues-and-caterers-news/Page-Error
I also tried to reference the rewrites with absolute URL's, this worked of course, but they were just redirecting instead of rewriting as you might expect.
EDIT - This is the other .htaccess file in the root directory, which is part of their existing site.
#Options +FollowSymlinks
RewriteEngine on
rewritecond %{http_host} ^domain.com [nc]
rewriterule ^(.*)$ http://www.domain.com/$1 [r=301,nc]
<IfModule mod_rewrite.c>
RewriteEngine on
redirect 301 /Cavendish.htm http://www.domain.com/
redirect 301 /grange.htm http://www.domain.com/
redirect 301 /restaurant/index.html http://www.domain.com/
redirect 301 /news/Save-money-by-booking-wedding-venues-in-Middlesex-at-off-peak-times.asp http://www.domain.com/
redirect 301 /news/default.asp http://www.domain.com/
EDIT - I thought this might be relevant.
The 404 error on the rewrite shows this path -
/l/i/domain.com/public/wedding-venues-and-caterers-news/Pages/news.php
But.. if I edit news.php and request SCRIPT_FILENAME it gives me the path..
/services/webpages/l/i/domain.com/public/wedding-venues-and-caterers-news/Pages/news.php
My guess is that something is affecting the default path.
Furthermore I have tried basic rewrites at root level, but these also 404.
Finally the issue has been solved.
As the server is hosted with BT Business I decided to email them to see if they could help.
A guy replied saying he had logged in to the server and modified the .htaccess and it now works fine.
He simply added the subfolder in front of the rewritten URL's.
IE:-
RewriteRule ^$ Pages/news.php
Became: -
RewriteRule ^$ wedding-venues-and-caterers-news/Pages/news.php
I am still unsure why the subdirectory is needed when the .htaccess file is inside that directory, my guess is it is something to do with their server settings.