github.com/krum110487/go-htaccess@v0.0.0-20240316004156-60641c8e7598/tests/data/apache_2_2_34/manual/rewrite/access.html.en (about) 1 <?xml version="1.0" encoding="ISO-8859-1"?> 2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> 3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head> 4 <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type" /> 5 <!-- 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 7 This file is generated from xml source: DO NOT EDIT 8 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 9 --> 10 <title>Using mod_rewrite to control access - Apache HTTP Server Version 2.2</title> 11 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" /> 12 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" /> 13 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" /><link rel="stylesheet" type="text/css" href="../style/css/prettify.css" /> 14 <script src="../style/scripts/prettify.min.js" type="text/javascript"> 15 </script> 16 17 <link href="../images/favicon.ico" rel="shortcut icon" /><link href="http://httpd.apache.org/docs/current/rewrite/access.html" rel="canonical" /></head> 18 <body id="manual-page"><div id="page-header"> 19 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p> 20 <p class="apache">Apache HTTP Server Version 2.2</p> 21 <img alt="" src="../images/feather.gif" /></div> 22 <div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div> 23 <div id="path"> 24 <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.2</a> > <a href="./">Rewrite</a></div><div id="page-content"><div class="retired"><h4>Please note</h4> 25 <p> This document refers to a legacy release (<strong>2.2</strong>) of Apache httpd. The active release (<strong>2.4</strong>) is documented <a href="http://httpd.apache.org/docs/current">here</a>. If you have not already upgraded, please follow <a href="http://httpd.apache.org/docs/current/upgrading.html">this link</a> for more information.</p> 26 <p>You may follow <a href="http://httpd.apache.org/docs/current/rewrite/access.html">this link</a> to go to the current version of this document.</p></div><div id="preamble"><h1>Using mod_rewrite to control access</h1> 27 <div class="toplang"> 28 <p><span>Available Languages: </span><a href="../en/rewrite/access.html" title="English"> en </a></p> 29 </div> 30 31 32 <p>This document supplements the <code class="module"><a href="../mod/mod_rewrite.html">mod_rewrite</a></code> 33 <a href="../mod/mod_rewrite.html">reference documentation</a>. It describes 34 how you can use <code class="module"><a href="../mod/mod_rewrite.html">mod_rewrite</a></code> to control access to 35 various resources, and other related techniques. 36 This includes many examples of common uses of mod_rewrite, 37 including detailed descriptions of how each works.</p> 38 39 <div class="warning">Note that many of these examples won't work unchanged in your 40 particular server configuration, so it's important that you understand 41 them, rather than merely cutting and pasting the examples into your 42 configuration.</div> 43 44 </div> 45 <div id="quickview"><ul id="toc"><li><img alt="" src="../images/down.gif" /> <a href="#blocked-inline-images">Forbidding Image "Hotlinking"</a></li> 46 <li><img alt="" src="../images/down.gif" /> <a href="#blocking-of-robots">Blocking of Robots</a></li> 47 <li><img alt="" src="../images/down.gif" /> <a href="#host-deny">Denying Hosts in a Blacklist</a></li> 48 <li><img alt="" src="../images/down.gif" /> <a href="#referer-deflector">Referer-based Deflector</a></li> 49 </ul><h3>See also</h3><ul class="seealso"><li><a href="../mod/mod_rewrite.html">Module documentation</a></li><li><a href="intro.html">mod_rewrite introduction</a></li><li><a href="remapping.html">Redirection and remapping</a></li><li><a href="vhosts.html">Virtual hosts</a></li><li><a href="proxy.html">Proxying</a></li><li><a href="rewritemap.html">Using RewriteMap</a></li><li><a href="advanced.html">Advanced techniques and tricks</a></li><li><a href="avoid.html">When not to use mod_rewrite</a></li></ul><ul class="seealso"><li><a href="#comments_section">Comments</a></li></ul></div> 50 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 51 <div class="section"> 52 <h2><a name="blocked-inline-images" id="blocked-inline-images">Forbidding Image "Hotlinking"</a></h2> 53 54 55 56 <dl> 57 <dt>Description:</dt> 58 59 <dd> 60 <p>The following technique forbids the practice of other sites 61 including your images inline in their pages. This practice is 62 often referred to as "hotlinking", and results in 63 your bandwidth being used to serve content for someone else's 64 site.</p> 65 </dd> 66 67 <dt>Solution:</dt> 68 69 <dd> 70 <p>This technique relies on the value of the 71 <code>HTTP_REFERER</code> variable, which is optional. As 72 such, it's possible for some people to circumvent this 73 limitation. However, most users will experience the failed 74 request, which should, over time, result in the image being 75 removed from that other site.</p> 76 <p>There are several ways that you can handle this 77 situation.</p> 78 79 <p>In this first example, we simply deny the request, if it didn't 80 initiate from a page on our site. For the purpose of this example, 81 we assume that our site is <code>www.example.com</code>.</p> 82 83 <div class="example"><p><code> 84 RewriteCond %{HTTP_REFERER} <strong>!^$</strong><br /> 85 RewriteCond %{HTTP_REFERER} !www.example.com [NC]<br /> 86 RewriteRule <strong>\.(gif|jpg|png)$</strong> - [F,NC] 87 </code></p></div> 88 89 <p>In this second example, instead of failing the request, we display 90 an alternate image instead.</p> 91 92 <div class="example"><p><code> 93 RewriteCond %{HTTP_REFERER} <strong>!^$</strong><br /> 94 RewriteCond %{HTTP_REFERER} !www.example.com [NC]<br /> 95 RewriteRule <strong>\.(gif|jpg|png)$</strong> /images/go-away.png [R,NC] 96 </code></p></div> 97 98 <p>In the third example, we redirect the request to an image on some 99 other site.</p> 100 101 <div class="example"><p><code> 102 RewriteCond %{HTTP_REFERER} <strong>!^$</strong><br /> 103 RewriteCond %{HTTP_REFERER} !www.example.com [NC]<br /> 104 RewriteRule <strong>\.(gif|jpg|png)$</strong> http://other.example.com/image.gif [R,NC] 105 </code></p></div> 106 107 <p>Of these techniques, the last two tend to be the most effective 108 in getting people to stop hotlinking your images, because they will 109 simply not see the image that they expected to see.</p> 110 111 </dd> 112 113 <dt>Discussion:</dt> 114 115 <dd> 116 <p>If all you wish to do is deny access to the resource, rather 117 than redirecting that request elsewhere, this can be 118 accomplished without the use of mod_rewrite:</p> 119 120 <div class="example"><p><code> 121 SetEnvIf Referer example\.com localreferer<br /> 122 <FilesMatch \.(jpg|png|gif)$><br /> 123 Order deny,allow<br /> 124 Deny from all<br /> 125 Allow from env=localreferer<br /> 126 </FilesMatch> 127 </code></p></div> 128 </dd> 129 </dl> 130 131 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 132 <div class="section"> 133 <h2><a name="blocking-of-robots" id="blocking-of-robots">Blocking of Robots</a></h2> 134 135 136 137 <dl> 138 <dt>Description:</dt> 139 140 <dd> 141 <p> 142 In this recipe, we discuss how to block persistent requests from 143 a particular robot, or user agent.</p> 144 145 <p>The standard for robot exclusion defines a file, 146 <code>/robots.txt</code> that specifies those portions of your 147 website where you which to exclude robots. However, some robots 148 do not honor these files. 149 </p> 150 151 <p>Note that there are methods of accomplishing this which do 152 not use mod_rewrite. Note also that any technique that relies on 153 the clients <code>USER_AGENT</code> string can be circumvented 154 very easily, since that string can be changed.</p> 155 </dd> 156 157 <dt>Solution:</dt> 158 159 <dd> 160 <p>We use a ruleset that specifies the directory to be 161 protected, and the client <code>USER_AGENT</code> that 162 identifies the malicious or persistent robot.</p> 163 164 <p>In this example, we are blocking a robot called 165 <code>NameOfBadRobot</code> from a location 166 <code>/secret/files</code>. You may also specify an IP address 167 range, if you are trying to block that user agent only from the 168 particular source.</p> 169 170 <div class="example"><p><code> 171 RewriteCond %{HTTP_USER_AGENT} ^<strong>NameOfBadRobot</strong><br /> 172 RewriteCond %{REMOTE_ADDR} =<strong>123\.45\.67\.[8-9]</strong><br /> 173 RewriteRule ^<strong>/secret/files/</strong> - [<strong>F</strong>] 174 </code></p></div> 175 </dd> 176 177 <dt>Discussion:</dt> 178 179 <dd> 180 <p> 181 Rather than using mod_rewrite for this, you can accomplish the 182 same end using alternate means, as illustrated here: 183 </p> 184 <div class="example"><p><code> 185 SetEnvIfNoCase User-Agent ^NameOfBadRobot goaway<br /> 186 <Location /secret/files><br /> 187 Order allow,deny<br /> 188 Allow from all<br /> 189 Deny from env=goaway<br /> 190 </Location> 191 </code></p></div> 192 <p> 193 As noted above, this technique is trivial to circumvent, by simply 194 modifying the <code>USER_AGENT</code> request header. If you 195 are experiencing a sustained attack, you should consider blocking 196 it at a higher level, such as at your firewall. 197 </p> 198 199 </dd> 200 201 </dl> 202 203 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 204 <div class="section"> 205 <h2><a name="host-deny" id="host-deny">Denying Hosts in a Blacklist</a></h2> 206 207 208 209 <dl> 210 <dt>Description:</dt> 211 212 <dd> 213 <p>We wish to maintain a blacklist of hosts, rather like 214 <code>hosts.deny</code>, and have those hosts blocked from 215 accessing our server.</p> 216 </dd> 217 218 <dt>Solution:</dt> 219 220 <dd> 221 <div class="example"><p><code> 222 RewriteEngine on<br /> 223 RewriteMap hosts-deny txt:/path/to/hosts.deny<br /> 224 RewriteCond ${hosts-deny:%{REMOTE_ADDR}|NOT-FOUND} !=NOT-FOUND [OR]<br /> 225 RewriteCond ${hosts-deny:%{REMOTE_HOST}|NOT-FOUND} !=NOT-FOUND<br /> 226 RewriteRule ^ - [F] 227 </code></p></div> 228 229 <div class="example"><p><code> 230 ##<br /> 231 ## hosts.deny<br /> 232 ##<br /> 233 ## ATTENTION! This is a map, not a list, even when we treat it as such.<br /> 234 ## mod_rewrite parses it for key/value pairs, so at least a<br /> 235 ## dummy value "-" must be present for each entry.<br /> 236 ##<br /> 237 <br /> 238 193.102.180.41 -<br /> 239 bsdti1.sdm.de -<br /> 240 192.76.162.40 -<br /> 241 </code></p></div> 242 </dd> 243 244 <dt>Discussion:</dt> 245 <dd> 246 <p> 247 The second RewriteCond assumes that you have HostNameLookups turned 248 on, so that client IP addresses will be resolved. If that's not the 249 case, you should drop the second RewriteCond, and drop the 250 <code>[OR]</code> flag from the first RewriteCond. 251 </p> 252 </dd> 253 </dl> 254 255 </div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div> 256 <div class="section"> 257 <h2><a name="referer-deflector" id="referer-deflector">Referer-based Deflector</a></h2> 258 259 260 261 <dl> 262 <dt>Description:</dt> 263 264 <dd> 265 <p>Redirect requests based on the Referer from which the request 266 came, with different targets per Referer.</p> 267 </dd> 268 269 <dt>Solution:</dt> 270 271 <dd> 272 <p>The following ruleset uses a map file to associate each Referer 273 with a redirection target.</p> 274 275 <div class="example"><p><code> 276 RewriteMap deflector txt:/path/to/deflector.map<br /> 277 <br /> 278 RewriteCond %{HTTP_REFERER} !=""<br /> 279 RewriteCond ${deflector:%{HTTP_REFERER}} =-<br /> 280 RewriteRule ^ %{HTTP_REFERER} [R,L]<br /> 281 <br /> 282 RewriteCond %{HTTP_REFERER} !=""<br /> 283 RewriteCond ${deflector:%{HTTP_REFERER}|NOT-FOUND} !=NOT-FOUND<br /> 284 RewriteRule ^.* ${deflector:%{HTTP_REFERER}} [R,L] 285 </code></p></div> 286 287 <p>The map file lists redirection targets for each referer, or, if 288 we just wish to redirect back to where they came from, a "-" is 289 placed in the map:</p> 290 291 <div class="example"><p><code> 292 ##<br /> 293 ## deflector.map<br /> 294 ##<br /> 295 <br /> 296 http://badguys.example.com/bad/index.html -<br /> 297 http://badguys.example.com/bad/index2.html -<br /> 298 http://badguys.example.com/bad/index3.html http://somewhere.example.com/ 299 </code></p></div> 300 301 </dd> 302 </dl> 303 304 </div></div> 305 <div class="bottomlang"> 306 <p><span>Available Languages: </span><a href="../en/rewrite/access.html" title="English"> en </a></p> 307 </div><div class="top"><a href="#page-header"><img src="../images/up.gif" alt="top" /></a></div><div class="section"><h2><a id="comments_section" name="comments_section">Comments</a></h2><div class="warning"><strong>Notice:</strong><br />This is not a Q&A section. Comments placed here should be pointed towards suggestions on improving the documentation or server, and may be removed again by our moderators if they are either implemented or considered invalid/off-topic. Questions on how to manage the Apache HTTP Server should be directed at either our IRC channel, #httpd, on Freenode, or sent to our <a href="http://httpd.apache.org/lists.html">mailing lists</a>.</div> 308 <script type="text/javascript"><!--//--><![CDATA[//><!-- 309 var comments_shortname = 'httpd'; 310 var comments_identifier = 'http://httpd.apache.org/docs/2.2/rewrite/access.html'; 311 (function(w, d) { 312 if (w.location.hostname.toLowerCase() == "httpd.apache.org") { 313 d.write('<div id="comments_thread"><\/div>'); 314 var s = d.createElement('script'); 315 s.type = 'text/javascript'; 316 s.async = true; 317 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier; 318 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s); 319 } 320 else { 321 d.write('<div id="comments_thread">Comments are disabled for this page at the moment.<\/div>'); 322 } 323 })(window, document); 324 //--><!]]></script></div><div id="footer"> 325 <p class="apache">Copyright 2017 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> 326 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="http://wiki.apache.org/httpd/FAQ">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div><script type="text/javascript"><!--//--><![CDATA[//><!-- 327 if (typeof(prettyPrint) !== 'undefined') { 328 prettyPrint(); 329 } 330 //--><!]]></script> 331 </body></html>