2

How do I configure apache to always return a 404 for URLs whose path component starts with two slashes (i.e. "//")?

We're getting such requests only from bots that don't understand scheme-relative URLs (so when they see a URL like "//somecdn.com/thingy.js" they request "http://oursite.com//somecdn.com/thingy.js"). They get a 404 response, which is fine. The problem is the 404 comes from our Django code, which dutifully then sends us an email saying someone got a 404 and their referrer was our site.

Here's our relevant apache config:

DocumentRoot /nowhere

Alias /static/ /our/static/files
Alias /uploads/ /our/uploaded/files

<VirtualHost :*80>

  ServerName oursite.com

  WSGIScriptAlias / /our/wsgi/script

</VirtualHost>

I tried inserting RedirectMatch 404 "^//" After DocumentRoot, but the request still ended up at the WSGI script. Changing the regex to "^/.*$" 404'd every request (as I would expect). "^\/\/" didn't seem to match anything.

I'm assuming I'm running afoul of some kind of multiple-/ squashing, but I don't know how to get around it.

This Apache 2.2.22 with mod_wsgi 3.3 on Ubuntu 12.04.

  • So I don't have to update my apache configs every time we use a scheme-relative URL with a new domainname. – morganwahl Dec 1 '14 at 15:16
  • For the record, I also tried defining a Location, which the Apache docs seem to say would be doable, but I couldn't figure out the right invocation. – morganwahl Dec 2 '14 at 20:47
2

You can use a RewriteCond on %{THE_REQUEST}:

THE_REQUEST

The full HTTP request line sent by the browser to the server (e.g., "GET /index.html HTTP/1.1"). This does not include any additional headers sent by the browser. This value has not been unescaped (decoded), unlike most other variables below.

Which unlike %{REQUEST_URI} will not have already been decoded or have duplicate slashes folded.

# method, space(s), then URL
RewriteCond %{THE_REQUEST} ^\S+\s+//
RewriteRule .* - [R=404]
  • So it is possible =). +1. – AD7six Dec 2 '14 at 20:36
  • I didn't think of looking for a variable with the unmodified path. I'll try that out when I get a chance. – morganwahl Dec 2 '14 at 20:45
  • Doesn't seem to be matching any request. I've added those directives at the root of the config, maybe they need to be within the virtualhost? – morganwahl Dec 10 '14 at 19:25
  • RewriteEnging on helps :-). – morganwahl Dec 10 '14 at 20:53
  • Also, @covener , this didn't work for me in the server config, (rewrite log had nothing written to it), but did work in the vhost. Oh well, good enough. – morganwahl Dec 10 '14 at 20:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.