Apache RewriteRule用于禁止除一个以外的所有URL

Question

I have a problem finding the right RewriteRules for my problem.

I want to configure a ruleset in a Apache vhost configuration.

My goal is that all URLs end at a 403 Forbidden. Only the /api call should go to the index.php, which is the entry-point for my symfony project.

Right now I have the following, but it does not work correctly:

        RewriteEngine On
        RewriteCond %{REQUEST_URI} !^/api$
        RewriteRule (.*) - [F]
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteRule ^(.*)$ index.php [QSA,L]

With this rules, all calls end as 403.

The other way round it works:

        RewriteCond %{REQUEST_URI} !^/api$

This way, all URls arrive in my symfony project. Except /api which ends at 403. But I dont want it this way. As mentioned I want it the other way round.

Thanks for your help!

Answer 1

You're close. Use the raw request to ensure people can't visit index.php .

RewriteCond %{THE_REQUEST} ^\S+\s+/api/?(?:\?\S*)?\s
RewriteRule ^ index.php [END]
RewriteRule ^ - [F]