Passthru back to apache after rewrite?

vt_dave

Hi,

I'm using Apache1.3.xx and php 1.4.xx and have developed a fairly large site. Large portions of this site are protected, so i have written a large security module stored at /security.php, i then created an apache rewrite rule stating "Send everything through /security.php"

RewriteEngine On
RewriteRule (.*) security.php

The module works great but the problem is it is SLOW. This is because after the page is validated as "can be hosted" it is now up to security.php to host these files.

For "text/html" files i just include them, but for binary files (images, zips, exe's) i have to fopen them, and stream the bytes out to the browser. This accounts for about 75% of the of the security.php code. My question is, after validation of a page, can I pass control BACK to apache so it can host it FAST like apache does?

Pitfalls i've hit are once the header is sent to security.php, control now resides there and any redirecting through header("Location: ") hits the rewrite rule and we have infinite redirecting.

Perhaps rewrite isn't what i even want to use? All i need to do is pre-pend some security code to EVERY file hosted.

Thanks in advance
-Dave

LordShryku

Well, I don't know if you have control over php.ini or not, but the prepending idea might increase your performance. With php.ini control, there is an option in there to auto_prepend_file that you could use to shove a security check in place. Without control, you could try using [man]ini_set[/man]...

vt_dave

Thanks for the reply, that's a great idea, i'll try that out as well. For apache 1.3.28+ i found a new Rewrite directive MaxRedirects which i'm looking into as well. further info can be found here:

http://www.sitepoint.com/article/mod_rewrite-no-endless-loops

Please keep the ideas coming, and all help is appreciated!!!!
-Dave

vt_dave

Further thoughts on the php.ini solution, that would only apply to php files correct? So if I want to handle binary files (to prevent deep linking) the security would be bypassed.

So maybe rewrite is the only option?

-Dave

vt_dave

No luck....

The MaxRedirects just limits the number of redirects to the same URI, so index.php will only redirect to index.php n times. My problem is I will be coming from /security.php to the page they requested,
which gets redirected back to security.php,
which forwards to the page they requested,
which gets redirected back to security......

You get the idea, so now i'm back to stuck 🙁

If ANYONE has an idea how to best accomplish this I would love to hear your thoughts.

Thanks again
-Dave