400 Bad Request when URL ends with % - apache

All the URLs ending with % is giving following error
"Bad Request,Your browser sent a request that this server could not understand."
I have redesigned my website and earlier as per my google analytics URLs ending with % was running.
I want to mention that I tried using same old htaccess but was not able to fix it. Other important change which I made was in hosting where I have pointed my server into a sub folder or the root.
Please help me in fixing it

% is a reserved character and should not be used for anything except percent encoding.
If you really need to pass the character on your url, use %25

Try this: 400 Bad Request when URL ends with %
(move your mouse over it and look at the URL, it's the URL of this page with a % added to it!)
The problem is probably that the % is used as an escape character for special signs like spaces or non latin characters, and the browser expects a code behind it.

Related

How to handle (REAL) blank space in Apache?

I know there are many questions like that in stackoverflow. But it is actually different :)
My problem is that Apache (2.4.6) just cannot handle white spaces in a url for instance aspecially used by cURL. Well consider I have a URL like following:
http://10.0.0.1:1234/Some Service/Root?func=getMessage
IF I browse this URL in any popular browser, they change the white space (' ') to %20. And in that way Apache can handle the request (or wget also does so).
However, when I use cURL, it does not change to %20 and in that case Apache return Error 400. I think the reason is, in the end of the GET Url, there is a white space and then specifies the used HTTP protocol comes.
such as:
GET Some Service/Root?func=getMessage HTTP1.1
The problem is I cannot touch or perform any update on cURL site. For example, I cannot perform a sed operation before cURL request. So consider like cURL site is like a blackbox. I have no control on that site. Therefore, I really have to solve this problem only in Apache. Unfortunately, It is the only option for me.
RewriteRules that I found work with if URL contains %20 instead of real white space (' '). For example \s only for if I write down %20 in the curl request. For example:
curl -v "http://10.0.0.1:1234/Some%20Service/Root?func=getMessage"
But if I use like:
curl -v "http://10.0.0.1:1234/Some Service/Root?func=getMessage"
then it gets Erro 400 because of the space.
For example following solution for %20 exists if there is one space or more then one:
#executes repeatedly as long as there are more than 1 spaces in URI
RewriteRule "^(\S*)\s+(\S* .*)$" $1+$2 [N,NE]
#executes when there is exactly 1 space in URI
RewriteRule "^(\S*)\s(\S*)$" /$1+$2 [L,R=302,NE]
So my link may not as simple as following:
http://10.0.0.1:1234/Some Service/Root?func=getMessage
Probably it may include one space :) but there will be more than one parameters like
http://10.0.0.1:1234/Some Service/Root?func=doSomething&id=123&pid=123&message=blabla&name=john&surname=doe
But in any case, ofcourse, I need also prevent possible problems if there is more then one blank.
Thanks in advance
It seems that Nginx can handle blanks or white spaces. Nginx does not give 400.

Escaping special characters in htaccess redirects

I'm having some issues with a few 301 redirects in htaccess. The original filenames/URLs were given special characters that I'm not quite sure how to properly escape. The URLs are structured like:
company%E2%80%99s-person-of-interest-aman%E2%80%99s-most-prestigious-%E2%80%9Cacademy-of-leaders-award%E2%80%9D
which equates to:
company’s-person-of-interest-aman’s-most-prestigious-“academy-of-leaders-award”
I've tried some things like
company\'-person-of-interest-aman\'s-most-prestigious-\"Cacademy-of-leaders-award\"
but that didn't work. What am I missing?
This is a UTF-8 character, which doesn't equate to \' or \" on the server side because ' and ’ are different characters according to the encoding spec. You could do one of two things:
1) You could simply rename the files, substituting the ASCII compatible characters for the UTF-8 ones
2) Use the percent encoded values in your redirect string directly.
Instead of
company\'-person-of-interest-aman\'s-most-prestigious-\"Cacademy-of-leaders-award\"
do
company%E2%80%99s-person-of-interest-aman%E2%80%99s-most-prestigious-%E2%80%9Cacademy-of-leaders-award%E2%80%9C
EDIT: while writing the answer, I also realized that your original expression for the redirect url isn't quite matching up even if your characters were ASCII:
company\'-person-of-interest-aman\'s-most-prestigious-\"Cacademy-of-leaders-award\"
should be
company\'s-person-of-interest-aman\'s-most-prestigious-\"academy-of-leaders-award\"

How to stop spaces in url showing %20?

If we look at a specific page the problem is occuring:
http://www.completeofficechairs.co.uk/RH%20Extend%20220
Where there are meant to be spaces, its showing %20.
So instead of http://www.completeofficechairs.co.uk/RH%20Extend%20220 its meant to be:
http://www.completeofficechairs.co.uk/RH Extend 220
How do I stop this?
Im on an apace web server, so could it be a htaccess mod?
Spaces are not allowed in URLs. They have to be escaped (their escape character is %20). I don't think there is any way to accomplish what you are trying to do.
Do not use spaces or replace them with underscores _ or dashes -. Your url will look better and be human-readable:
http://www.completeofficechairs.co.uk/RH-Extend-220

Regex rule to match % sign in url for apache mod rewrite

Hello my rewrite rule is failling sometimes because my urls have % signs in them.
For example this url:
http://www.chillisource.co.uk/product/Grocery/Dr.%20Burnoriums%20Psycho%20Juice/1/B005MSE5KG/Psycho_Juice_70%_Ghost_Pepper
This is my rewrite rule:
RewriteRule ^product/([a-zA-Z]+)/([\sa-zA-Z0-9\-\+\.]+)/([0-9]+)/([A-Z0-9]+)/([a-zA-Z0-9]+) /product?&cat=$1&q=$2&page=$3&prod=$4&prodName=$5
How can I modify the 5th rule ([a-zA-Z0-9]+) to not fail on when there is a % in the product name ?
Thanks in advance.
Perhaps, it's not %20, but space. That is, the URL passed to rewrite adter urldecoding. If not, then just add percent sign to the range. (if yes — space).
---- Forget this part, I misunderstood the question ----
From what I get from the mod_rewrite documentation (http://httpd.apache.org/docs/current/mod/mod_rewrite.html), you should not have to deal with hex encoded characters (I assume that from the following statement:
THE_REQUEST
The full HTTP request line sent by the browser to the server (e.g., "GET /index.html HTTP/1.1"). This does not include any additional headers sent by the browser. This value has not been unescaped (decoded), unlike most other variables below.
In fact, using mod_rewrite would be practically impossible since you'd have to deal with that EVERYWHERE, e.g., you can always write %41 instead of 'A'.
--- But the following still is true ---
But your rewrite rule can't work, at least not with the request URL you posted: The last part of the regex "([a-zA-Z0-9]+)" is FAR too strict. In this case, it fails for the following reasons:
It lacks a treatment of the percent sign, as in "70%"
You forgot to include the underscore "_"
Try adding at least these two characters ("[a-zA-Z0-9%_]+") and it should work.

Request a resource with percent sign in path

I need to request a file www.myserver.de/file%.pdf .
The file exists and requesting the renamed copy www.myserver.de/file.pdf works.
Is this expected behaviour?
% is the character for URL escape sequences. Try using %25 which decodes to a single % sign.
% has a special meaning in URLs, so you need to escape it in order to refer to files with %s in their names.
Try www.myserver.de/file%25.pdf instead.