Strange redirection to the Apache Test Page

A RewriteRule keeps redirecting me to the Apache test page

[Marino]

Hello,

I've this set of rules in my .htaccess:
RewriteCond %{REQUEST_URI} somestring [OR]
RewriteCond %{QUERY_STRING} somestring
RewriteRule .* - [F,L]

If I key in "http://mysite.com/somestring" or "http://mysite.com/index.php?a=somestring", I'm redirected to the expected 403 Forbidden page.

If I key in "http://mysite.com?a=somestring", the URL is rewritten as "http://mysite.com/?a=somestring" and I'm redirected to the unexpected-at-all Apache test page.

As we say in French, "I give my tongue to the cat".

Thanks in advance,

Marino

[jdMorgan]

La chat dit (the cat says):

Likely a problem with either "UseCanonicalName on" or the definition of DocumentRoot -- both in the server configuration file (for example, httpd.conf).

If you cannot correct the server configuration, you could try to correct the invalid slashless HTTP requests before doing your security test... like this:

RewriteCond %{THE_REQUEST} !^[A-Z]{3,9} /[^\ ]*\ HTTP/
RewriteRule (.*) http://www.example.com/$1 [R=301,L]
#
[i]RewriteCond $1 !^path-to-custom-403-error-page\.html$[/i]
RewriteCond $1 somestring [OR]
RewriteCond %{QUERY_STRING} somestring
RewriteRule (.*) /$1? [F]

This will force a redirect to add the leading slash if it is missing. The changes to the security rule are as follows:

If you use a custom 403 error page defined by ErrorDocument, it must be excluded from the rule to prevent a recursive 403 error using the first RewriteCond (in italic font).

[L] used with [F] is redundant, so I removed it.

Adding "?" to the end of the substitution URL will clear the query string, so that it is not passedd to the custom 403 error page.

This may be worth a try, especially if you do not have access to the server configuration files. Look at your server error log file if you have access to it.

Jim

[Marino]

Purrrrrr.... Thanks for your answer.

I tried the rewriting part, but it did not work, though I know it should have. I also tried;

RewriteRule /\?(.*) http://example.com/spip.php?$1 [R=301]

And nope! Should have worked too...

So I tried:

RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /?\?([^\ ]*)\ HTTP/
RewriteRule .* http://example.com/spip.php?%1 [R=301]

and it worked.

Ok, now for the second part. What does the "$1" refers to? What is the need to RewriteRule (.*) /$1? [F] if the URL is to be forbidden?

[edited by: jdMorgan at 4:18 pm (utc) on Oct. 6, 2008]
[edit reason] Please use example.,com [/edit]

[g1smd]

The stuff matched by (.*) on the left is bundled into the server variable $1 and can be re-used on the right. That's the power of this server directive.

You can have a maximum of 9 such $ variables.

Likewise something in (brackets) on the RewriteCond line is bundled into %1 and can be re-used again.