Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a web site using mod_rewrite to get some clean urls and custom 404 pages. My .htaccess file looks like this:

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^(.*)$ index.php?clean_url=$1 [QSA,L]
</IfModule>

What puzzles me is that if the URL contains a %2F (url-encoded /) the server seems to force a 404. As an example, http://example.com/category/article would be a normal article, but then http://example.com/category%2farticle gives a server-generated 404 page. (not the custom 404 page)

I wouldn't have expected this... why this is happening? Is there a way around it?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

The URLs http://example.com/category/article and http://example.com/category%2farticle are not equal. According to RFC 2616 §3.2.3, reserved characters have special significance (which is, after all, the whole point of URL escaping). RFC 2396 §2.2 lists / as such a reserved character. In the context of HTTP URLs, / delimits path elements, while %2f is a literal slash.

In Apache, AllowEncodedSlashes On would prevent the request from being immediately rejected with a 404.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.