You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Jens Schleusener <Je...@t-online.de> on 2017/05/15 14:46:52 UTC
[users@httpd] How to customize error responses (while using mod_rewrite)?
Hi,
my general question is how I can generate customized error responses
while using the mod_rewrite module. Yes, I know the page
https://httpd.apache.org/docs/2.4/custom-error.html
but the ErrorDocument directive allows only to do some customization per
status code optionally refined by context but I want to output customized
error pages specifically for many different request conditions determined
mainly by various RewriteCond directives.
Here an actual special example: On a server running httpd 2.4 I want to
disallow the HTTPS access using the TLSv1.0 protocol. To order do that not
too "hard" but a little bit client-friendly TLSv1.0 accesses aren't yet
really disabled but redirected for a limited period to an according
information page. Currently that is realized with the following
configuration
RewriteCond %{SSL:SSL_PROTOCOL} ^TLSv1$
RewriteRule (.*) /https_tlsv10.html [R=permanent,L]
The big disadvantage of that solution is that it returns an obviously
incorrect HTTP response status code 301 ("Moved Permanently") but I want
that the server returns an appropriate 4xx or 5xx status code (ok, I am not
sure what would be an "appropriate" one). By the way, the current 301
redirection let some bots (using still TLSv1.0) nevertheless access that
information page many thousand times (but maybe they would that do also
with a returned 4xx or 5xx response status code).
Unfortunately for the RewriteRule directive for e.g. a Rewrite flag R=4xx
instead of R=permanent isn't allowed (only 300-399, why?) so I had
considered the usage of the <If> directive but didn't find a working
solution.
So maybe the only working solution is the detour via an external CGI
program.
Probably I have something overseen, so any ideas or comments?
Jens
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: How to customize error responses (while using mod_rewrite)?
Posted by Jens Schleusener <Je...@t-online.de>.
On Mon, 15 May 2017, Jens Schleusener wrote:
> On Mon, 15 May 2017, Eric Covener wrote:
>
>> On Mon, May 15, 2017 at 12:32 PM, Jens Schleusener
>> <Je...@t-online.de> wrote:
>>> Ok, in that case one could use the ErrorDocument directive (it works for
>>> me
>>> principally) but how can one can achieve that that directive is not used
>>> globally but only specific for the above case?
>>>
>>> The idea to set in the above RewriteRule additionally an environment
>>> variable for e.g. via a "E=tlsv10:1" flag and using
>>>
>>> <If "env('tlsv10') -eq 1">
>>> ErrorDocument 412 /https_tlsv10.html
>>> </If>
>>>
>>> seems not to work, the Apache httpd outputs the "412" standard error
>>> message.
>>
>> Re: the If misfiring, its because <if is evaluated shortly before
>> RewriteRule. You can check SSL envvars directly, or use setenvif
>> instead of RewiteRule to set the envvar.
>
> Thanks for the hint, I will try it.
With your hint and some testing I ended up now with the following by
choosing for now the response error status code 412 ("Precondition
Failed"):
<If "%{SSL_PROTOCOL} == 'TLSv1'">
ErrorDocument 412 /https_tlsv10.html
</If>
RewriteCond %{SSL:SSL_PROTOCOL} ^TLSv1$
RewriteRule !^/https_tlsv10.html$ - [R=412,L]
So my special example problem seems to be solved but the original general
question how one can generate customized error responses while using the
mod_rewrite module seems to have as general answer only the use of an
appropriate CGI program.
Thanks for the help
Jens
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: How to customize error responses (while using mod_rewrite)?
Posted by Jens Schleusener <Je...@t-online.de>.
On Mon, 15 May 2017, Eric Covener wrote:
> On Mon, May 15, 2017 at 12:32 PM, Jens Schleusener
> <Je...@t-online.de> wrote:
>> Ok, in that case one could use the ErrorDocument directive (it works for me
>> principally) but how can one can achieve that that directive is not used
>> globally but only specific for the above case?
>>
>> The idea to set in the above RewriteRule additionally an environment
>> variable for e.g. via a "E=tlsv10:1" flag and using
>>
>> <If "env('tlsv10') -eq 1">
>> ErrorDocument 412 /https_tlsv10.html
>> </If>
>>
>> seems not to work, the Apache httpd outputs the "412" standard error
>> message.
>
> Re: the If misfiring, its because <if is evaluated shortly before
> RewriteRule. You can check SSL envvars directly, or use setenvif
> instead of RewiteRule to set the envvar.
Thanks for the hint, I will try it.
> But Is it much better than a redirect or rewrite to some document that
> describes the problem but has a 200 status code?
That is a great question that I cannot answer it (you had tried it
indirectly).
It becomes a little bit off-topic but an answer to this question would
very important to me since I provide an FOSS offering server with more or
less frequently changing releases so that the server tries to redirect
normally failing accesses to URLs according to no longer available
releases to "guessed" URLs of the corresponding current release. If the
server does that transparently responding with a 200 status code a human
client may get not really the resource he has requested although he may
have the impression and additionally search engines may index resources
that are not 100% related to the accessed URLs. Also a status code 301
would be in this sense wrong since it implies the same problem.
So currently the server answers with a 404 ("Not Found") but with an
informative error page containing links to the new resources. Probably
appropriate for human users but bad for search engines that get a lot of
error responses (probably not regarding the contents of the error page).
I would be happy about a status code like 310 (a merge of 301 and 410)
saying "Resource is no longer available but here is its successor" ;-)
Regards
Jens
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Re: How to customize error responses (while using mod_rewrite)?
Posted by Eric Covener <co...@gmail.com>.
On Mon, May 15, 2017 at 12:32 PM, Jens Schleusener
<Je...@t-online.de> wrote:
> Ok, in that case one could use the ErrorDocument directive (it works for me
> principally) but how can one can achieve that that directive is not used
> globally but only specific for the above case?
>
> The idea to set in the above RewriteRule additionally an environment
> variable for e.g. via a "E=tlsv10:1" flag and using
>
> <If "env('tlsv10') -eq 1">
> ErrorDocument 412 /https_tlsv10.html
> </If>
>
> seems not to work, the Apache httpd outputs the "412" standard error
> message.
Re: the If misfiring, its because <if is evaluated shortly before
RewriteRule. You can check SSL envvars directly, or use setenvif
instead of RewiteRule to set the envvar.
But Is it much better than a redirect or rewrite to some document that
describes the problem but has a 200 status code?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
[users@httpd] Re: How to customize error responses (while using mod_rewrite)?
Posted by Jens Schleusener <Je...@t-online.de>.
On Mon, 15 May 2017, Eric Covener wrote:
> On Mon, May 15, 2017 at 10:46 AM, Jens Schleusener
> <Je...@t-online.de> wrote:
>> Unfortunately for the RewriteRule directive for e.g. a Rewrite flag R=4xx
>> instead of R=permanent isn't allowed (only 300-399, why?) so I had
>> considered the usage of the <If> directive but didn't find a working
>> solution.
>
> Other codes are allowed, but you can't do anything with the
> substitution in this case. The reason is that if you return any status
> code like this, it short-circuits the processing of the URL by the
> rest of the server, so nobody is around to convert the URL to a file
> and serve it.
>
> The manual says:
> Any valid HTTP response status code may be specified, using the syntax
> [R=305], with a 302 status code being used by default if none is
> specified. The status code specified need not necessarily be a
> redirect (3xx) status code. However, if a status code is outside the
> redirect range (300-399) then the substitution string is dropped
> entirely, and rewriting is stopped as if the L were used.
Thanks for the clarification. But I am a little bit slow-witted and don't
understand what "substitution string is dropped entirely" means. I assume
not only the further rewriting rules are skipped but unfortunately also
the output of the defined substitution page (/https_tlsv10.html) in
RewriteCond %{SSL:SSL_PROTOCOL} ^TLSv1$
RewriteRule !^/https_tlsv10.html$ /https_tlsv10.html [R=412,L]
(the 412 is here just a placeholder for a really correct response status
code) and the Apache httpd outputs "only" the standard page for an 412
error?
Ok, in that case one could use the ErrorDocument directive (it works for
me principally) but how can one can achieve that that directive is not
used globally but only specific for the above case?
The idea to set in the above RewriteRule additionally an environment
variable for e.g. via a "E=tlsv10:1" flag and using
<If "env('tlsv10') -eq 1">
ErrorDocument 412 /https_tlsv10.html
</If>
seems not to work, the Apache httpd outputs the "412" standard error
message.
Regards
Jens
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] How to customize error responses (while using mod_rewrite)?
Posted by Eric Covener <co...@gmail.com>.
On Mon, May 15, 2017 at 10:46 AM, Jens Schleusener
<Je...@t-online.de> wrote:
> Unfortunately for the RewriteRule directive for e.g. a Rewrite flag R=4xx
> instead of R=permanent isn't allowed (only 300-399, why?) so I had
> considered the usage of the <If> directive but didn't find a working
> solution.
Other codes are allowed, but you can't do anything with the
substitution in this case. The reason is that if you return any status
code like this, it short-circuits the processing of the URL by the
rest of the server, so nobody is around to convert the URL to a file
and serve it.
The manual says:
Any valid HTTP response status code may be specified, using the syntax
[R=305], with a 302 status code being used by default if none is
specified. The status code specified need not necessarily be a
redirect (3xx) status code. However, if a status code is outside the
redirect range (300-399) then the substitution string is dropped
entirely, and rewriting is stopped as if the L were used.
--
Eric Covener
covener@gmail.com
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] How to customize error responses (while using mod_rewrite)?
Posted by Marat Khalili <mk...@rqc.ru>.
Just in case you are stuck, you can always use internal redirect to a CGI script (or PHP or whatever) and write whatever response you want with that script. It's kind of cheating but it should work.
--
With Best Regards,
Marat Khalili
On May 15, 2017 5:46:52 PM GMT+03:00, Jens Schleusener <Je...@t-online.de> wrote:
>Hi,
>
>my general question is how I can generate customized error responses
>while using the mod_rewrite module. Yes, I know the page
>
> https://httpd.apache.org/docs/2.4/custom-error.html
>
>but the ErrorDocument directive allows only to do some customization
>per
>status code optionally refined by context but I want to output
>customized
>error pages specifically for many different request conditions
>determined
>mainly by various RewriteCond directives.
>
>Here an actual special example: On a server running httpd 2.4 I want to
>
>disallow the HTTPS access using the TLSv1.0 protocol. To order do that
>not
>too "hard" but a little bit client-friendly TLSv1.0 accesses aren't yet
>
>really disabled but redirected for a limited period to an according
>information page. Currently that is realized with the following
>configuration
>
> RewriteCond %{SSL:SSL_PROTOCOL} ^TLSv1$
> RewriteRule (.*) /https_tlsv10.html [R=permanent,L]
>
>The big disadvantage of that solution is that it returns an obviously
>incorrect HTTP response status code 301 ("Moved Permanently") but I
>want
>that the server returns an appropriate 4xx or 5xx status code (ok, I am
>not
>sure what would be an "appropriate" one). By the way, the current 301
>redirection let some bots (using still TLSv1.0) nevertheless access
>that
>information page many thousand times (but maybe they would that do also
>
>with a returned 4xx or 5xx response status code).
>
>Unfortunately for the RewriteRule directive for e.g. a Rewrite flag
>R=4xx
>instead of R=permanent isn't allowed (only 300-399, why?) so I had
>considered the usage of the <If> directive but didn't find a working
>solution.
>
>So maybe the only working solution is the detour via an external CGI
>program.
>
>Probably I have something overseen, so any ideas or comments?
>
>Jens
>
>
>---------------------------------------------------------------------
>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>For additional commands, e-mail: users-help@httpd.apache.org