mod_rewrite rules on subdirectory not woring due to parent rules

Question

My application lives in one directory and is served from a public folder, and I have an API endpoint in a sub-directory of public, both of which are redirected to their own respective index.php files. Until a recent server migration everything was working great. Now though, the API requests are being intercepted by the parent directory. Here are the vhost <directory...> segments in question...

    # application root
    <Directory "/path/to/app">
        Options FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    # public root
    <Directory /path/to/app/public>
        RewriteBase /
        RewriteCond %{REQUEST_FILENAME} -s [OR]
        RewriteCond %{REQUEST_FILENAME} -l [OR]
        RewriteCond %{REQUEST_FILENAME} -d
        RewriteRule ^.*$ - [NC,L]
        RewriteRule ^.*\.(media.php|png|jpg|gif|ico)$ media.php [NC,L]
        RewriteRule ^.*\.(xml|txt|css|js)$ static.php [NC,L]
        RewriteRule ^.*$ index.php/ [NC,L]
        errordocument 404 /error.php?id=404
    </Directory>

    # API
    <Directory /path/to/app/public/api>
        Header set Access-Control-Allow-Methods "PUT, GET, POST, DELETE, HEAD, OPTIONS"
        RewriteCond %{HTTP:Authorization} ^(.*)
        RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
        RewriteRule ^(.*)$ index.php [L,NC]
    </Directory>

I'm using Apache 2.4.53. The /path/to/app/public directives are working as expected, any media file extensions are redirected to media.php, any text based files are redirected to static.php, and everything else is sent to index.php with a 404 error fallback.

If I request mydomain.com/api/ alone I get the proper API specific error message, because the ./api/ directory physically exists. But as soon as I request a proper endpoint like mydomain.com/api/v1.0/some-enddpoint/ which should be captured and redirected at the ./api/index.php file, I'm getting a 404 error which is coming from the parent directory.

Appreciate any help!

Answer 1

It looks like your <Directory /path/to/app/public/api> container is inheriting the RewriteBase directive from the parent <Directory /path/to/app/public> container. This will happen if RewriteOptions MergeBase is set, or possibly other options relating to inheritance.

It doesn't look like you need the RewriteBase / directive in the <Directory /path/to/app/public> container, so you could simply remove it. However, check to see if you have defined this elsewhere in the config.

Alternatively, set a RewriteBase /api in the <Directory /path/to/app/public/api> container. OR, prefix the substitution string with the full URL-path, for example:

RewriteRule . /api/index.php [END]

I also reduced ^(.*)$ to simply ., since you only need this to be processed for non-empty URL-paths and you should be using the END flag, instead of L to prevent an unnecessary loop by the rewrite engine. (The NC flag is also superfluous.)

If I request example.com/api/ alone I get the proper API specific error message, because the ./api/ directory physically exists.

In this case, index.php is likely be served by mod_dir (DirectoryIndex), not mod_rewrite.