lucy24 - 6:33 am on Feb 7, 2013 (gmt 0)
:: bump ::
I did a little more experimenting on this. MAMP and test site, not real life.
The plus side to working on "real" files is that you don't have to go through all those (/|\.html)$ contortions that you go through when a request might be for either a directory or a secondary page.
But then the rule will only kick in after mod_dir has done its stuff, instead of intercepting requests on their first pass through your htaccess. And you can't slam the door on people asking for nonexistent files; all you can give them is your basic 404. This is not as satisfying. (Also potentially riskier if they take the extra step of picking up the 404 page, which would probably have more information than the 403 page.)
LocationMatch would be nicer, since it deals with URLs rather than physical files, but you can't use it in htaccess.
A further quirk is that RewriteEngine On isn't inherited from the body of an htaccess into a <FilesMatch> envelope within the same htaccess. You have to say it all over again. If the apache docs mention this, it's in very small print; I only worked it out by trial and error. You would presumably have to repeat any [L] statements as well ("If the request is for anything in the /boilerplate/ directory, stop right here" -- that kind of thing).
I've got a lurking suspicion that it's only cost-effective if you can pack all your RewriteRules into one envelope or another.