apache mod_rewrite 用于尾随斜线问题

mod_rewrite for trailing slash problem

提问by

I'm pulling my hair out on what should be an insanely simple problem. We are running WebSphere IHS (Apache) through an F5 BigIP. BigIP is doing the https translation for us. Our url (changed for web, not valid) is https://superniftyserver.com/lawson/portal.

我正在研究一个非常简单的问题。我们正在通过 F5 BigIP 运行 WebSphere IHS (Apache)。BigIP 正在为我们做 https 翻译。我们的网址（已更改为网络，无效）是https://superniftyserver.com/lawson/portal。

When someone types in just that without the slash after portal, Apache assumes "portal" to be a file and not a directory. When Apache finds out what it is, it sends the 301 Permanent Redirect. But since Apache knows only http, it sends the URL as http://superniftyserver.com/lawson/portal/which then creates problems.

当有人在门户后输入没有斜杠的内容时，Apache 假定“门户”是一个文件而不是目录。当 Apache 发现它是什么时，它会发送 301 Permanent Redirect。但是由于 Apache 只知道 http，所以它将 URL 作为http://superniftyserver.com/lawson/portal/发送，这会产生问题。

So I tried a server level httpd.conf change for mod_rewrite, this is one of the dozens of combinations I've tried.

所以我尝试对 mod_rewrite 进行服务器级别的 httpd.conf 更改，这是我尝试过的数十种组合之一。

RewriteEngine on RewriteRule ^/lawson/portal(.*) /lawson/portal/$1

RewriteRule 上的 RewriteEngine ^/lawson/portal(.*) /lawson/portal/$1

I also tried RewriteRule ^/lawson/portal$ /lawson/portal/

我也试过 RewriteRule ^/lawson/portal$ /lawson/portal/

Among many other things... What am I missing?

在许多其他事情中......我错过了什么？

采纳答案by Kevin Hakanson

If you can't get an answer on the RewriteRule syntax, here are two other options for you: Write an custom iRule on BigIp (see F5 DevCentral) that looks for 301 responses and convert them to SSL; let the URL pass into your WebSphere server and do a programmatic redirect that sends out HTTPS. However, because F5 terminates the SSL connection, you have to set a custom header that you configure (see PQ86347) so the Java request.getScheme() works as you would expect.

如果您无法获得有关 RewriteRule 语法的答案，这里有另外两个选项供您选择： 在 BigIp 上编写自定义 iRule（请参阅F5 DevCentral），以查找 301 响应并将它们转换为 SSL；让 URL 传递到您的 WebSphere 服务器并执行发送 HTTPS 的编程重定向。但是，因为 F5 会终止 SSL 连接，所以您必须设置一个您配置的自定义标头（请参阅PQ86347），以便 Java request.getScheme() 可以按预期工作。

回答by Kevin Hakanson

Fixed!

固定的！

SOL6912: Configuring an HTTP profile to rewrite URLs so that redirects from an HTTP server specify the HTTPS protocol

SOL6912：配置 HTTP 配置文件以重写 URL，以便来自 HTTP 服务器的重定向指定 HTTPS 协议

---

---

Updated: 8/7/07 12:00 AM

更新：8/7/07 12:00 AM

A ClientSSL virtual server is typically configured to accept HTTPS connections from a client, decrypt the SSL session, and send the unencrypted HTTP request to the web server.

ClientSSL 虚拟服务器通常配置为接受来自客户端的 HTTPS 连接，解密 SSL 会话，并将未加密的 HTTP 请求发送到 Web 服务器。

When a requested URI does not include a trailing slash (a forward slash, such as /, at the end of the URI), some web servers generate a courtesy redirect. Without a trailing slash, the web server will first treat the resource specified in the URI as a file. If the file cannot be found, the web server may search for a directory with the same name and if found, send an HTTP 302 redirect response back to the client with a trailing slash. The redirect will be returned to the client in HTTP mode rather than HTTPS, causing the SSL session to fail.

当请求的 URI 不包含尾部斜杠（URI 末尾的正斜杠，例如 /）时，某些 Web 服务器会生成礼节性重定向。如果没有尾部斜杠，Web 服务器将首先将 URI 中指定的资源视为文件。如果找不到该文件，Web 服务器可能会搜索具有相同名称的目录，如果找到，则向客户端发送带有尾部斜杠的 HTTP 302 重定向响应。重定向会以 HTTP 方式而不是 HTTPS 方式返回给客户端，导致 SSL 会话失败。

Following is an example of how an HTTP 302 redirect response causes the SSL session to fail:

以下是 HTTP 302 重定向响应如何导致 SSL 会话失败的示例：

· To request an SSL session, a user types https://www.f5.com/stuffwithout a trailing slash.

· 要请求 SSL 会话，用户键入https://www.f5.com/stuff，不带尾部斜杠。

· The client browser sends an SSL request to the ClientSSL virtual server, which resides on the BIG-IP LTM system.

· 客户端浏览器向位于 BIG-IP LTM 系统上的 ClientSSL 虚拟服务器发送 SSL 请求。

· The BIG-IP LTM system then decrypts the request and sends a GET /stuff command to the web server.

· 然后，BIG-IP LTM 系统解密请求并向 Web 服务器发送 GET /stuff 命令。

· Since the /stuff file does not exist on the web server, but a /stuff/ virtual directory exists, the web server sends an HTTP 302 redirect response for the directory, but appends a trailing slash to the resource. When the web server sends the HTTP 302 redirect response, it specifies HTTP (not HTTPS).

· 由于 /stuff 文件在 Web 服务器上不存在，但 /stuff/ 虚拟目录存在，因此 Web 服务器会针对该目录发送 HTTP 302 重定向响应，但会在资源后附加一个斜杠。当 Web 服务器发送 HTTP 302 重定向响应时，它指定 HTTP（而非 HTTPS）。

· When the client receives the HTTP 302 redirect response, it sends a new request to the BIG-IP LTM virtual server that specifies HTTP (not HTTPS). As a result, the SSL connection fails.

· 当客户端收到 HTTP 302 重定向响应时，它会向指定 HTTP（而非 HTTPS）的 BIG-IP LTM 虚拟服务器发送一个新请求。因此，SSL 连接失败。

Configuring an HTTP profile to rewrite URLs

配置 HTTP 配置文件以重写 URL

In BIG-IP LTM version 9.x you can configure an HTTP profile to rewrite URLs so that redirects from an HTTP server specify the HTTPS protocol. To do so, perform the following procedure:

在 BIG-IP LTM 版本 9.x 中，您可以配置 HTTP 配置文件来重写 URL，以便来自 HTTP 服务器的重定向指定 HTTPS 协议。为此，请执行以下过程：

1. Log in to the Configuration utility.

2. Click Local Traffic.

3. Click Profiles.

4. Click the Create button.

5. Type a name for the profile.

6. Choose http from the Parent Profile drop-down menu.

7. Under Settings, set Redirect Rewrite to All, Matching, or Nodes, depending upon your configuration

1. 登录到配置实用程序。

2. 单击本地流量。

3. 单击配置文件。

4. 单击创建按钮。

5. 键入配置文件的名称。

6. 从父配置文件下拉菜单中选择 http。

7. 在设置下，根据您的配置，将重定向重写设置为全部、匹配或节点

For example:

例如：

o Choose All to rewrite any HTTP 301, 302, 303, 305, or 307 redirects to HTTPS

o 选择全部将任何 HTTP 301、302、303、305 或 307 重定向重写为 HTTPS

o Choose Matching to rewrite redirects when the path and query URI components of the request and the redirect are identical (except for the trailing slash)

o 当请求和重定向的路径和查询 URI 组件相同（尾部斜杠除外）时，选择匹配以重写重定向

o Choose Node to rewrite redirects when the redirect URI contains a node IP address instead of a host name, and you want the system to change it to the virtual server address

o 当重定向 URI 包含节点 IP 地址而不是主机名，并且您希望系统将其更改为虚拟服务器地址时，选择节点重写重定向

1. Click Finished.

8. 单击完成。

You must now associate the new HTTP profile with the ClientSSL virtual server.

您现在必须将新的 HTTP 配置文件与 ClientSSL 虚拟服务器相关联。

回答by Christoph Trautwein

Try this:

尝试这个：

# Trailing slash problem
RewriteCond    %{DOCUMENT_ROOT}%{REQUEST_FILENAME} -d
RewriteRule    ^(.+[^/])$           https://<t:sitename/>/ [redirect,last]

回答by Tanj

LoadModule rewrite_module                modules/mod_rewrite.so

make sure that line is somewhere in you httpd.conf file

确保该行在您的 httpd.conf 文件中