Why is heroku redirecting "folder-like" requests via 301 to http?

user_2642721 0
Viewed 84

I have the an spa running on heroku and I wanted to get it running on forced https. I'm using the PHP stack to have some basic authentication on it, nothing special only one index.php. Thought it should be easy, but I have a strange redirect there: When I access /appStart for example, I get this in logs:

10.8.149.25 - - [13/Feb/2021:19:23:57 +0000] "GET /appStart HTTP/1.1" 301 248 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_1_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36

this is my .htaccess:


RewriteEngine On

#Force SSL 
RewriteCond %{HTTP:X-Forwarded-Proto} !https 
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=302]

# Handle Authorization Header
RewriteCond %{HTTP:Authorization} .
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
# Send Requests To Front Controller...
RewriteCond %{REQUEST_URI} !\.(png|css|js|json|txt|ico)$
RewriteCond %{REQUEST_URI} !_nuxt
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^ index.php [L]

I switched the https rewrite to 302 in my .htaccess to be sure that the redirect isn't comming from my rules, so ... Where is this 301 coming from???

heroku .htaccess redirect
1 Answers

If appStart is a physical directory and you request /appStart (no trailing slash) then mod_dir (Apache) will "fix" the URL with a 301-redirect to append the trailing slash. ie. /appStart/.

You should be requesting /appStart/ (with a trailing slash) if appStart is a physical directory.

UPDATE: Just to be sure: DirectorySlash Off will solve my issue, right?

(I'm assuming your .htaccess file is located at /appStart/.htaccess?)

It's actually a bit more complicated than that. Without the trailing slash on the directory then your mod_rewrite directives in .htaccess won't be processed and the front-controller (internal rewrite to index.php) will fail. Other issues like DirectoryIndex (mod_dir) will also fail - although you don't seem to be dependent on that here (you are using mod_rewrite instead).

The net result is that you'll likely get a 403 Forbidden response (unless you have mod_autoindex is enabled - in which case you'll get an auto-generated directory listing, despite the DirectoryIndex document being present! See the security warning for the DirectorySlash directive in the Apache docs.)

In short, Apache needs the trailing slash.

If you disable the auto-appending of the trailing slash with DirectorySlash Off then you'll need to manually append this trailing slash yourself to avoid these issues. And you'll need to do this in the parent/root .htaccess file instead, not /appStart/.htaccess.

For example... move your existing /appStart/.htaccess file to the root /.htaccess file, include the DirectorySlash Off directive and change the last RewriteRule directive to read:

RewriteRule ^appStart appStart/index.php [L]

However, that doesn't necessarily solve the issue completely (depending on how your application is structured), since any relative URL-paths in your application (to static resources etc.) are now relative to the document root, not the /appStart/ subdirectory, as they would have been before. This is a client-side URL issue and can only be resolved by "fixing" the client-side URLs.

user_3694340
Related