Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This works; I'm not having trouble, but I want to be certain that this is bulletproof.

I came up with a neat little .htaccess redirect, but I am not sure if it is secure; do you know?

<IfModule mod_rewrite.c>

    RewriteEngine On

    RewriteRule ^goto/([a-z]+)/?$ /$1/ [R]


I think as long as the server is configured correctly and the files handle authentication autonomously, then it shouldn't be a security issue. Also, being that the rewrite rule only works with characters a-z and one slash I doubt they could jump around directories by injecting stuff into the URL I think...

share|improve this question
I'm going to follow up on the verdict via my blog, describing why it is the right, or wrong way to attempt this. That was the link to it. – r.crandall Nov 18 '09 at 22:09
If you have a comment about the question post it here, if you have a comment about an alternative, post it on the blog. The blog will have the summary and the alternatives when this is finished. – r.crandall Nov 18 '09 at 23:07
That blog url is dead. :p – Kzqai May 13 '10 at 1:28

The .htaccess redirect itself is indeed "secure" (unless a severe remotely-exploitable bug is found in mod_rewrite or mod_rewrite-related Apache code).

Let us have a look at a sample request coming in:

  1. Apache (mod_rewrite) checks if the rule matches
  2. if it does: Apache doesn't do anything else except for sending a redirection header to the browser
  3. if it doesn't: Apache processes the request as any other (i.e. starts looking for a matching file, ...)

The only problem I can think of is somehow redirecting the visitor to a file s/he's not expected to see. For example, if Apache is allowed to "follow symlinks", and the rewrite rule points at a symlink to e.g. your /etc/passwd, then Apache will act as instructed and will send your /etc/passwd to the browser. But that is not really a security issue of .htaccess redirect.

share|improve this answer

It's actually moot because of the [R] flag.

Because you're sending an external redirect it means security shits over to the point when the server receives the rewritten URL. At this point it's just like it would be if someone lifted a URL from a keylogger on your computer. The server should treat the rewritten URL via the new request like there was never a rewrite.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.