[OR] else

[lucy24]

Word to the wise ...

I was cleaning up one site's htaccess, getting rid of some long-defunct fake referers, organizing others and so on. Latest annoyance: disqus-- where I really do have a profile --has suddenly decided to call itself "disq.us", a TLD that I've never before met in a non-spam referer. Same pattern as goo.gl and youtu.be, but who blocks Greenland? Yes, I know there exist real .us sites, just as there exist real Ukrainian sites; I just don't get them as referers.

I always follow-up htaccess changes by requesting some minor file like robots.txt or a stylesheet to ensure I haven't created a 500-class error. Always.

Little did I know...
Ending your final RewriteCond in [OR] does not create a 500 error. It, instead, creates a null condition-- that is, something that will always evaluate to true --meaning that the rule always executes. This particular rule says: block all requests for pages.

It took me approximately 24 hours to discover this mysterious upsurge in blocked human requests.

:: sob ::

Aside: Humans, sure, but in a couple of cases maybe not very intelligent humans. If the same request is blocked five separate times, always leading to a 403 page explaining possible actions to take, wouldn't you eventually try taking one of those actions instead of just making the same request over and over again?

[not2easy]

ouch. Nothing worse than self inflicted stuff, it can be so hard to pin down. Interesting find though. :(

[LifeinAsia]

wouldn't you eventually try taking one of those actions instead of just making the same request over and over again?

Not some of the humans I know. :(

[whitespace]

Thanks for "taking one for the team"! Good to know!

I suppose I've always assumed that a "dangling" [OR] was perhaps "ignored"!

Just trying to rationalise this behaviour... I wonder if it works this way in order to satisfy the implicit AND?

a null condition-- that is, something that will always evaluate to true

Is the "null condition" your term or have you seen that mentioned (officially) elsewhere? It's just that I would expect anything that was null-like to evaluate to false. The "Higgs boson" of Apache config files?!

[lucy24]

taking one for the team

Yeah, what a good thing it was just me and not Ms. Amazon or Mr. Wikipedia or similar ;)

"Null condition" is my own terminology. It seemed the best way to explain

RewriteCond aaa [OR]
RewriteCond bbb [OR]
RewriteCond ccc [OR]
RewriteRule blahblah

being interpreted as if there were some hidden condition "ddd" that always evaluates to TRUE, or else the rule wouldn't execute. Like, say,

RewriteCond %{REQUEST_URI} .*

"there was a request" -- well, of course there was, or we wouldn't be here in the first place. Or something like (blah1|blah2|) always returning a result, because everything contains an empty string. (I've often done this by mistake, but fortunately only in a text editor.)

I do caution people to watch out for a trailing [OR] ... but I just assumed it would throw a 500 error, as most syntax errors do.

[keyplyr]

"[OR] else"

Whew! for a minute I thought I was reading one of those notes from my ex :(

[lucy24]

"Or else I'll never speak to you again!"
"Is that a promise?"

[keyplyr]

Were you a vaudevillian in a former life?