trim url query string with .htaccess

Question

On my site I use a session id when accessing a pages form content. The sessionid in the url isn't normally shown because it's accessed through jQuery .load so the url doesn't change. The page in reference above needs to be accessed by some outside domains directly. I have used the following PHP at the top of the form page, to show the entire page.

<?php
    $code = $_GET['sessionid'];
    $referrer = $_SERVER['HTTP_REFERER'];

    if(strcmp( $code , 'XXXXX' ) !=0) {
    if (preg_match("/alloweddomain.com/",$referrer)) {
header('Location: http://www.mydomain.com/desiredpage.php?sessionid=XXXXX');
} else {
header("Location: http://www.mydomain.com/otherpage.php");
        }
    }
?>

Is there a way with .htaccess to remove the session ID? I've tried the following but get 500 Internal Server Errors.

RewriteEngine On
RewriteBase /
"lots of 301 redirects"
HTTP_REFERER variable RewriteCond %{HTTP_REFERER} !aloweddomain.com RewriteCond %{QUERY_STRING} !="sessionid=XXXXX" RewriteRule .* /desiredpage.php? [R=301,L]

***EDIT**** used this, filling in the appropriate details

RewriteCond %{HTTP_REFERER} !**aloweddomain.com** [OR]
RewriteCond %{QUERY_STRING} !=sessionid=**XXXXX**
RewriteRule .* /**desiredpage**.php? [R=301,L]

just get FF error that it can't complete redirect

briancray.com/2010/03/18/htaccess-hack-remove-url-query-strings — jcubic
– jcubic, Commented Mar 9, 2011 at 20:10
"THIS WILL BREAK ANY FUNCTIONALITY THAT DEPENDS ON QUERY STRINGS" - im guessing that would be my normal use of session ID? — Dirty Bird Design
– Dirty Bird Design, Commented Mar 9, 2011 at 20:16

jcubic · Accepted Answer · 2011-03-09 22:34:20Z

1

you forget newlines

RewriteCond %{HTTP_REFERER} !aloweddomain.com [OR]
RewriteCond %{QUERY_STRING} !=sessionid=XXXXX
RewriteRule .* /desiredpage.php? [R=301,L]

This will redirect all url's that don't came from aloweddomain.com or don't have Query_String. I forget about [OR] if there is nor [OR] then then the two conditions must be true.

and if desiredpage.php is simply page that show that you can't access the site then you can put 403 Forbidden instead of redirect

RewriteRule .* - [F,L]

If you want to call it from AJAX or custom domain.

if (preg_match('/domain.com/', $_SERVER['HTTP_REFERER']) || 
    $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest') {
   // allowed
   header('Location: http://www.mydomain.com/desiredpage.php');
} else {
   // not allowed
   header('Location: http://www.mydomain.com/otherpage.php');
}

code for desiredpage.php

if (!(preg_match('/domain.com/', $_SERVER['HTTP_REFERER']) ||
    $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest')) {
   header('Location: http://www.mydomain.com/otherpage.php');
}

edited Mar 9, 2011 at 22:34

answered Mar 9, 2011 at 20:17

jcubic

67.1k58 gold badges252 silver badges466 bronze badges

Sign up to request clarification or add additional context in comments.

14 Comments

Dirty Bird Design Over a year ago

and this won't affect the entire site, just that page right? Nope doesn't work, I just get a FF message "Problem loading Page...redirecting in a way ff cannot resolve"

Dirty Bird Design Over a year ago

How about if I just check to see if it's either an xmlHTTPrequest (mine) or from allowed domain? that would get rid of the stupid sessionid right?

jcubic Over a year ago

You can't check for custom headers in .htaccess but I put solution in php.

jcubic Over a year ago

But if you put redirect in php script then user can check destination page and access it normally and bypass your check. Best way is to not redirect to other pages but do your stuff in the same file.

Dirty Bird Design Over a year ago

@jcubic - real close now. the only way i could get it to load page was with the page name and extension added to '/domain.com/page.php' Warning: preg_match() [function.preg-match]: Unknown modifier 'd' in /home/xxx/public_html/desiredpage.php on line 2 Warning: Cannot modify header information - headers already sent by (output started at /home/xxx/public_html/desiredpage.php:2) in /home/xxx/public_html/desiredpage.php on line 8

|

Collectives™ on Stack Overflow

trim url query string with .htaccess

1 Answer 1

14 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

14 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related