1

This works; I'm not having trouble, but I want to be certain that this is bulletproof.

I came up with a neat little .htaccess redirect, but I am not sure if it is secure; do you know?

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule ^goto/([a-z]+)/?$ /$1/ [R]
</IfModule>

I think as long as the server is configured correctly and the files handle authentication autonomously, then it shouldn't be a security issue. Also, being that the rewrite rule only works with characters a-z and one slash I doubt they could jump around directories by injecting stuff into the URL I think...

0

2 Answers 2

1

It's actually moot because of the [R] flag.

Because you're sending an external redirect it means security shits over to the point when the server receives the rewritten URL. At this point it's just like it would be if someone lifted a URL from a keylogger on your computer. The server should treat the rewritten URL via the new request like there was never a rewrite.

0

The .htaccess redirect itself is indeed "secure" (unless a severe remotely-exploitable bug is found in mod_rewrite or mod_rewrite-related Apache code).

Let us have a look at a sample request coming in:

  1. Apache (mod_rewrite) checks if the rule matches
  2. if it does: Apache doesn't do anything else except for sending a redirection header to the browser
  3. if it doesn't: Apache processes the request as any other (i.e. starts looking for a matching file, ...)

The only problem I can think of is somehow redirecting the visitor to a file s/he's not expected to see. For example, if Apache is allowed to "follow symlinks", and the rewrite rule points at a symlink to e.g. your /etc/passwd, then Apache will act as instructed and will send your /etc/passwd to the browser. But that is not really a security issue of .htaccess redirect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .