mod_rewrite: No More Endless Loops!

Looking To The Change Log...

The change logs for Apache 2.0.45 and 1.3.28 contain the following notes:

Apache 2.0.45:
Prevent endless loops of internal redirects in mod_rewrite by
aborting after exceeding a limit of internal redirects. The
limit defaults to 10 and can be changed using the RewriteOptions
directive. PR 17462. [André Malo]

Apache 1.3.28:
backport from 2.x series: Prevent endless loops of internal redirects
in mod_rewrite by aborting after exceeding a limit of internal redirects.
The limit defaults to 10 and can be changed using the RewriteOptions
directive. PR 17462. [André Malo]

These two releases of the popular Web server introduce a new option for the RewriteOptions directive: MaxRedirects.

mod_rewrite, for those that don’t know, is a powerful module that allows you to handle incoming URI requests and more.

This article will explain the use of and advantages of the MaxRedirects option. Web hosting companies that offer the mod_rewrite module should take note of these reasons to upgrade to the latest Apache release. Keeping your Web server up-to-date is a must. Hosting companies that do not offer the mod_rewrite module are encouraged to enable it.

Before we proceed, you’ll need a working Apache installation with mod_rewrite installed. Please see my FAQ for installation help.

A Typical Case

Let’s start with an example.

We want to redirect all URIs to a PHP script. The redirection will be internal, so the client, for example, a browser, will not see that a redirection has occurred. To do this, we create in the document root an .htaccess file that contains these rules:

# Enable rewrite engine
Options +FollowSymLinks
RewriteEngine On

# Redirect internally all URIs to /index.php
RewriteRule .* /index.php [L]

However, this will not work – it’ll freeze your Apache Web server. Why?

The problem is this line:

RewriteRule .* /index.php [L]

Simply put, that rule ‘says’ “Redirect all requests to /index.php.”. That may sound like what we originally set out to achieve, but, in practice, we will not get the results we expect.

The following is what happens with a request for www.example.net/path/to/:

Phase A

• The URI is /path/to/
• RewriteRule will rewrite the URI from path/to/ to /index.php
• An internal redirection will be made for /index.php
• The internal redirection will be treated as a new request, so it will be parsed again (see phase b)

Phase B

• The previous internal redirection, /index.php, will be processed again by the rewrite engine
• RewriteRule will rewrite index.php to /index.php
• An internal redirection will be made for /index.php

At this point the rewrite engine will run Phase B continuously and the Apache Web server will freeze.