Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently having issues with encoded slashes on my Apache server. The url structure is as follows:

www.site.com/url/http%3A%2F%2Fwww.anotherurl.com

I am then getting a 404 error from Apache (my application should handle all errors.)

Apparently the AllowEncodedSlashes On directive should help me in this spot, but it doesn't seem to be making any impact whatsoever. I've placed it in the httpd.conf like so:

<VirtualHost *:80>
DocumentRoot /var/www/vhosts/site.com/httpdocs
ServerName site.com

AllowEncodedSlashes On
</VirtualHost>

Then restarted Apache with the /etc/init.d/httpd restart command.

I've been trying to solve this issue for days now. I've some people saying that the AllowEncodedSlashes directive works, and some people saying that it's buggy and should be depreciated. I'm wondering if there's an issue with AllowEncodedSlashes and clean URL's working together?

Anyway, all help is appreciated. Thanks in advance.

share|improve this question
    
Not actually an answer, so posting as a comment: Do you need to have the encoded http:// in the URL? That is, are these requests coming from somewhere over which you don't have control? Because if you control the source, the simplest solution would be to (a) drop the http:// and just make it implict, and (b) don't bother encoding your / characters. This would make requests look like site.com/url/www.anotherurl.com/some/path, which is something that will simply work. –  larsks Dec 10 '10 at 15:28
    
Hi larsks. The system is an API, so no I don't have control. There's also the chance that the user will need to input a URI with forward slashes in, too. –  tommizzle Dec 10 '10 at 15:37
add comment

2 Answers 2

I've never tried it, but just reading the apache manual for AcceptEncodedSlashes, it says:

Turning AllowEncodedSlashes On is mostly useful when used in conjunction with PATH_INFO.

http://httpd.apache.org/docs/2.0/mod/core.html#acceptpathinfo

Is AcceptPathInfo turned on in your configuration?

EDIT: just noticed that the ':' is encoded with %3A .. perhaps that's causing the issue.

share|improve this answer
    
Thanks for the reply DTest. AcceptPathInfo On didn't change anything. I've also tried it without %3A and just the forward slashes... same error. –  tommizzle Dec 12 '10 at 20:21
    
Try with it as ':' instead of removing it completely. I'm assuming it works fine without the encoded slashes? –  DTest Dec 12 '10 at 21:00
    
Is this a reverse proxy setup? If so, from this link old.nabble.com/URL-Encoding-td18850769.html it might be possible to set it up as 'nocanon' httpd.apache.org/docs/2.2/mod/mod_proxy.html: "Normally, mod_proxy will canonicalise ProxyPassed URLs. But this may be incompatible with some backends, particularly those that make use of PATH_INFO. The optional nocanon keyword suppresses this, and passes the URL path "raw" to the backend. Note that may affect the security of your backend, as it removes the normal limited protection against URL-based attacks provided by the proxy." –  DTest Dec 12 '10 at 21:20
add comment
up vote 0 down vote accepted

Seems like it's a known bug in Apache: https://issues.apache.org/bugzilla/show_bug.cgi?id=35256

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.