Rewrite Rules... ...when to use L & R

[decdim]

I'm currently working on some RewriteCond/RewriteRule to redirect users "looking" for deleted folders & "formmail". Thankfully I've found numerous "code snippets" to choose from, what I'm wondering is why some use [L] (stop rewriterule after this) and others don't?

For my "formmail" RewriteRule, they are above "banned bots" - I don't believe it would have any effect on them, since they have their own RewriteRule.

As for [R], I've seen it a few times to let the user/browser know that they have been redirected but in both cases I don't want them to know they have been... ...so I see no point in using [R].

Here are the code snippets:

RewriteCond %{REQUEST_URI} (.?mail.?form¦form¦(GM)?form.?.?mail¦.?mail)(2¦to)?\.?(asp¦cgi¦exe¦php¦pl¦pm)?$ [NC]
RewriteRule .* MyDomain/cgi-bin/MytrapFileName [L] # names have been changed

RewriteCond %{REQUEST_URI} (.?mail.?form¦form¦(GM)?form.?.?mail¦.?mail)(2¦to)?\.?(asp¦cgi¦exe¦php¦pl¦pm)?$ [NC]
RewriteRule .* path_to_my_trap_script [L]

Options +FollowSymlinks
RewriteBase /
RewriteRule %{REQUEST_URI} ^/blocking_directory/$ /ban_page.html [L]

RewriteRule (form.*mail¦mail.*(form¦to¦2)) /path_to_script.pl [NC,L]

RewriteCond %{REQUEST_URI} (.?mail.?form¦form¦(GM)?form.?.?mail¦.?mail)(2¦to)?\.?(asp¦cgi¦exe¦php¦pl¦pm)?$ [NC]
RewriteRule .* path_to_trap.extension [F]

RedirectMatch cgi-bin/formmail.pl formmail.pl

Notice the differences, including Rewrite-Cond/Base/Rule and one RedirectMatch...

Thanks!

[jdMorgan]

decdim,

Why do some RewriteRules use the [L] flag, and not others?

If you do not use [L], mod_rewrite will continue to process RewriteRules, and continue to modify (rewrite) the URL if it matches any more of these RewriteRules. This can lead to unexpected results if a rewritten URL does match subsequent RewriteRules, and it is a big waste of time if the URL won't match any subsequent RewriteRule.

My recommendation is to *always* use [L], unless you have a specific reason not to.

Why do some RewriteRules use the [R] flag, and not others?

Mod_rewrite can accomplish two main things: First it can generate external redirects, and second it can make internal file substitutions. These are very different functions, because a redirect involves a "handshake" with the client (browser) invoking a second HTTP request, and an internal file subsitution simply serves the contents of an alternate file, rather than that of the requested file. So, a redirect involves action outside the server, and a rewrite does not.

External redirection:

RewriteRule ^quux\.html$ http://www.example.com/foo.html [R=301,L]

If quux.html is requested, this code sends a response to the browser that says, "The resoure you requested, http://www.example.com/quux.html, has been moved permanently to this URL: http://www.example.com/foo.html. Please re-request it from that address, and update your URL database if possible."

This ends the current HTTP transaction; The client (browser, search engine spider, etc.) must re-request the resource from the new URL provided in the 301 response using a completely-new HTTP request.

The form "[R=302]" or just "[R]" can be used to return a 302-Moved Temporarily response; This tells the client that the resource should be re-requested from a temporary alternate URL, and that it will return at some time to the original URL. Therefore, it tells clients (e.g. search engines) *not* to update their links. Therefore, I do not recommend using a 302 except for good cause; You can do serious damage to your search engine rankings by using a 302 when you really need a 301.

Internal rewriting:

RewriteRule ^quux\.html$ /foo.html [L]

This rule simply causes the server to serve the contents of the file "foo.html" whenever the resource "quux.html" is requested. No action by the client is required, and actually, the client will be completely unaware that the substitution has taken place.

It does not even matter if "quux.html" exists, since it is used here only as an alternate name for the foo.html resource.

Jim

[decdim]

Excellent explaination Jim, I appreciate it the help in this!

Regards!
---
Follow-Up:

Within my .htaccess, everything is set for [F] (fail, 403) but I plan on including [L] since 2 parts of the file need to be "hidden". That is one for the formmail and one for the deleted directories.

Would it be in my interest to put those two seperate from the [F], so that there would less of a chance of problems? Like putting the 2 sets below my bot bans and other misc. blocks...

Thanks!

[decdim]

# Email
RewriteCond %{REQUEST_URI} ^/FormMail [NC,OR]
RewriteCond %{REQUEST_URI} ^/FormMail\.(cgi¦pl¦php) [NC,OR]
RewriteCond %{REQUEST_URI} ^/cgi(\-local¦\-bin)/FormMail [NC,OR]
RewriteCond %{REQUEST_URI} ^/cgi(\-local¦\-bin)/FormMail\.(cgi¦pl¦php) [NC]
RewriteRule .* /error/trap.php [L]

# Deleted directories; wanting to gather info on users visiting those...
RewriteCond %{REQUEST_URI} ^/(somedirectory¦anotherdirectory¦etc) [NC]
RewriteRule .* /error/oops.php [L]
---
Question:

How do I <snip> the formmail down into just 1 or 2 lines; ^/ should mean anything before the following right? I tried it once but suddenly received attempts on formmail through cgi-bin & cgi-local. Giving a 404 vs. 403 (currently set with [F] but want to redirect quietly eventually). Even tried some of the examples found here and they don't seem to take due to attemps varying between no directory, cgi-bin, cgi-local & cgi-sys. So I want to be able to "tag" all those options (no sub directory or sub directory).
---
Edit: Confirmed through my own testing the RewriteRule works properly! :)

2nd Edit: Didn't catch your post originally. Thanks Jim on the "reduction" on the lines...hate to have duplication in my .htaccess and the verification!

I appreciated all the help & patience!
Regards!

[edited by: decdim at 9:04 pm (utc) on Feb. 3, 2004]

[jdMorgan]

> ^/ means anything before the following right?

No, it means " match only strings starting with '/' "

Your second and fourth pattern are unneccessary, because the are redundant with the first and third patterns:

# Here is where I want to redirect "formmail" requests quietly to my "bad bot" php to gather info on the user...
# Email
RewriteCond %{REQUEST_URI} ^/FormMail [NC,OR]
RewriteCond %{REQUEST_URI} ^/cgi(\-local¦\-bin)/FormMail [NC,OR]
RewriteRule .* /directory/script-name.php [L]

...but then, that allows a further reduction to:

RewriteCond %{REQUEST_URI} ^/(/cgi(\-local¦\-bin)/)?FormMail [NC,OR]
RewriteRule .* /directory/script-name.php [L]

...and finally to:

RewriteRule ^(cgi(\-local¦\-bin)/)?FormMail /directory/script-name.php [NC,L]

---
> For the RewriteRule, would that send any attempts for formmail into my "bad-bot.php" (or do I need the full [domain.tld)?...]

No, it sends any FormMail requests to "/directory/script-name.php" as written. You do not need (or want) to do an external redirect, because that would require the cooperation of the user-agent.

# Deleted directories; wanting to gather info on users visiting those...
RewriteCond %{REQUEST_URI} ^/(somedirectory¦anotherdirectory¦etc) [NC]
RewriteRule .* /error/oops.php [L]

Here again, this can be reduced:

RewriteRule ^(somedirectory¦anotherdirectory¦etc) /error/oops.php [NC,L]

Jim