'self-rewriting' urls

help me understand how they get rewritten

[turbosuperman]

I'm trying to understand how a certain website works. It's filled with urls pointing to itself in the form of:

[site.com...]
[site.com...]

etc.

What the PHPSESSID means I do not know yet. I'm confused that there's no 'foo' directory in the DocumentRoot of the site, only foo.php. I tried to search for mod_rewrite trickery, but have not found any:

root@host# grep -i rewrite /etc/apache/httpd.conf
LoadModule rewrite_module /usr/lib/apache/1.3/mod_rewrite.so
###LoadModule rewrite_module /usr/lib/apache/1.3/mod_rewrite.so
root@host# grep -i include /etc/apache/httpd.conf
# LoadModule includes_module /usr/lib/apache/1.3/mod_include.so
Options Indexes Includes FollowSymLinks MultiViews
root@host#

Please help me understand how this server is configured.

[superpower]

PHPSESSID is just the user session id set by PHP. It's used to maintain user info/preferences for the user's browsing session on the site (without using cookies).

It's dumb to put PHPSESSID in the url (messy,not secure) and doesn't have to be there... I don't know why they are doing that.

[turbosuperman]

Thanks for the explanation, but the real problem for me (at least for now) is figuring out what is going on with with the site.com/foo/2 part of the url. I'm ignoring the PHPSESSID until I know where it is going.

[superpower]

You could be looking at the wrong conf file. Are you sure there are not other httpd.conf or httpd.include files on the server? Maybe grep the entire conf directory for RewriteEngine or RewriteRule.

[turbosuperman]

I'm pretty sure the httpd.conf is the correct one because when I mess it up, apache fails to start:

root@host# /etc/init.d/apache start
Starting web server: apacheSyntax error on line 5 of /etc/apache/httpd.conf:
ServerTokens not allowed here
failed

Doing "grep -ir rewrite /etc" gives me only this new line:

/etc/php4/apache/php.ini:url_rewriter.tags = "a=href,area=href,frame=src,input=src,form=fakeentry"

Also "find / -iname '.htaccess'" returns no results.

I'm completely lost here.

[sonjay]

Have you checked for an .htaccess file in the site's DocumentRoot directory?

[jdMorgan]

Options Indexes Includes FollowSymLinks MultiViews

Content-negotiation is enabled, so the server will look for a "best match" if the exact URL does not resolve to a file that exists.

See Apache mod_negotiation.

Jim

[turbosuperman]

thanks jdMorgan. MultiViews is in fact the reason why foo.php gets executed. foo.php then parses REQUEST_URI to find out about what it should do.