Trailing slashes

S

ScotWatson

New Member
Messages
16
Reaction score
0
Points
1
I am working on an API and I have come across the issue of trailing slashes. So far, I have been storing the php code for each endpoint into a file called index.php in a folder with the name of the endpoint. When I try with the trailing slash, I get the response generated by the php code. When I try without the trailing slash, I get a 301 (Permanently Moved) redirect, then the request and response I get with the trailing slash. I did some research and found that this behavior can be obtained with certain commands in the .htaccess file, but I do not have any of those commands in that file. Is it standard for servers to behave this way? Is it possible to change this behavior?
Web searches seem to reveal that although there is no official standard, it seems like there is a de facto standard to not use trailing slashes in APIs. Even if the behavior is turned off, in order to not have a trailing slash, I would need a file with the name of the endpoint and no file extension, but then it would not have a php extension, so the code would never get interpreted. So I am not sure how to support not having a trailing slash without an intermediate redirect.
Sorry for the long post, but these questions seem too closely related to make them separate.
 
fusio

fusio

Member
Messages
64
Reaction score
5
Points
8
.htaccess files help configure routes and so on...
Can you put the code of what you are explaining?
 
S

ScotWatson

New Member
Messages
16
Reaction score
0
Points
1
I have just added a file to illustrate the issue. It is called index.php and is stored in a folder called test under the public_html folder. The file contains the following code:
PHP: 
<?php
// Handles https://www.scotwatson.x10.mx/test/
echo "Testing...";
?>
To see the issue, open the browser, open DevTools, click on Network tab, select "Disable cache". If "https://www.scotwatson.x10.mx/test/" is entered into the address line, the result is:
Screenshot 2024-12-28 111326.png
If "https://www.scotwatson.x10.mx/test" is entered into the address line, the result is:
Screenshot 2024-12-28 111352.png
This shows that "https://www.scotwatson.x10.mx/test" uses an intermediate 301 redirect response to provide the same result as "https://www.scotwatson.x10.mx/test/". This is the behavior I referenced above. Is this typical? Is there a setting change this? If so, how do I control the responses to "https://www.scotwatson.x10.mx/test" vs "https://www.scotwatson.x10.mx/test/"?
 
S

ScotWatson

New Member
Messages
16
Reaction score
0
Points
1
Also, my .htaccess file, which is at the public_html folder, contains the following:
Code: 
Options -Indexes
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
Header set Access-Control-Allow-Headers "*, Authorization"
 
fusio

fusio

Member
Messages
64
Reaction score
5
Points
8
I get canceled
Captura7.PNG
Anyway, in your screenshots there is a message, if you went to the console section, maybe it will shed some light on the problem.
 
S

ScotWatson

New Member
Messages
16
Reaction score
0
Points
1
The message is "Page layout may be unexpected due to Quirks Mode". This is because it was not legal HTML. I just changed the code in test/index.php to:
PHP: 
<?php
// Handles https://www.scotwatson.x10.mx/test/
echo "<!DOCTYPE html>";
echo "<html>";
echo "  <head>";
echo "    <meta charset=\"utf-8\">";
echo "  </head>";
echo "  <body>Testing...</body>";
echo "</html>";
?>
The message is gone, but I get the same responses.
It is concerning that you are getting canceled when you try to go to that site. I am not and I do not know how to reproduce the problem, so I do not know how to troubleshoot it.
 
fusio

fusio

Member
Messages
64
Reaction score
5
Points
8
First you are working with APIs and the APIs are treated in JSON format (in this case)
You must establish the relevant headers in that file. I really don't understand what you want to do but, as I told you, when working with APIs the JSON format is used
 
S

ScotWatson

New Member
Messages
16
Reaction score
0
Points
1
Most of the time, but not always. For example, the authorization endpoint of OAuth2 returns HTML, and the token endpoint in OAuth2 requires a request of content type of "application/x-www-form-urlencoded".
I have just changed the test/index.php file to:
PHP: 
<?php
// Handles https://www.scotwatson.x10.mx/test/
header("Content-Type: application/json");
echo "{";
echo "  \"property1\": \"value1\"";
echo "}";
?>
I still see the same behavior.
As far as the canceled request, try refreshing a few times. I sometimes get an additional header:
alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Maybe that header is causing an issue on your end? I have no idea why it shows up, or why it is intermittent.
 
M

mlabsx10

New Member
Messages
18
Reaction score
0
Points
1
There are a variety of ways that API endpoints are hosted, and there is no standard format for API requests/responses. Likewise, the content you return from your PHP script will have no effect on the redirect behavior you are observing.

The directory slash redirect is a standard feature of most web servers. You can disable that behavior in Apache by adding the following code to your .htaccess file:
Apache config: 
DirectorySlash Off

However, changing that setting will introduce a new issue: The server will NOT automatically run the index.php inside the folder when the path has no trailing slash and will return a 403 error or a directory listing instead. If I recall correctly, there’s an easy way to resolve that with rewrite rules. I will check and report back in a bit.

Why does this behavior exist in the first place? Strictly speaking, a path ending without a slash refers to a file and one ending in a slash refers to a directory. However, most systems that offer paths do not require strict interpretation, meaning a path ending without a slash can alternatively refer to a directory.
 
Last edited:
M

mlabsx10

New Member
Messages
18
Reaction score
0
Points
1
The following should result in the behavior you’re looking for. I have tested it and it works in LiteSpeed, which X10Hosting uses. Included comments explain what each line does.
Apache config: 
# Disable File Name Searching and Directory Listings
Options -MultiViews -Indexes +FollowSymLinks
# Disable Directory Slash Redirect
#  - NOTE: This is supported by Apache, but ignored by
#    LiteSpeed. It is included here in case this code
#    is to be used in the future on an Apache server.
DirectorySlash Off
# Enable URL Rewriting
RewriteEngine On
# Allow Rewriting Rules to apply to URLs referencing
# directories without a trailing slash
RewriteOptions AllowNoSlash
# Forward requests for directories to the configured
# DirectoryIndex files via appending a slash internally
#  - NOTE: This internal forward will NOT result in a
#    301 redirect.
RewriteCond %{REQUEST_FILENAME} -d
# Only append a slash when one doesn’t already exist,
# so we don’t end up in a loop appending slashes
RewriteRule ^.*[^/]$ $0/ [QSA,L]
 
Last edited:
S

ScotWatson

New Member
Messages
16
Reaction score
0
Points
1
Thank you, I just tried out your code and it does remove the 301 redirect, excellent!
You said in your first response that "DirectorySlash Off" turns off the redirect behavior, but in the second response you said that "DirectorySlash Off" is ignored by LiteSpeed, yet the code worked. Why? (Sorry, I still have a lot to learn about .htaccess files.)
If I wanted different code to run based on whether the trailing slash exists or not, is that possible?
Any idea why fusio is getting a canceled request when he tries to go to the test endpoint? Do you get the same result?
 
M

mlabsx10

New Member
Messages
18
Reaction score
0
Points
1
LiteSpeed actually ignores two of those commands:
Apache config: 
DirectorySlash Off
RewriteOptions AllowNoSlash

From my testing, LiteSpeed evaluates rewrite rules prior to its built-in directory redirect support, in contrast with Apache, which performs directory redirects first via its mod_dir module and then evaluates rewrite rules. Since LiteSpeed checks rewrite rules first, the DirectorySlash Off command is unnecessary, but in Apache, it must be turned off for a rewrite rule to process it.

The RewriteOptions AllowNoSlash command is also unnecessary in LiteSpeed because rewrite rules can already apply to directory URLs that are missing the trailing slash. In Apache, this option must be set in order to override the default behavior and allow rewrite rules to handle those URLs.

ScotWatson said:
If I wanted different code to run based on whether the trailing slash exists or not, is that possible?
Click to expand...
Yes, using rewrite rules you can forward any arbitrary URL to a file on the server. See the following example. Also, check out Apache’s mod_rewrite (RewriteRule and RewriteCond) documentation linked here for more details.
Apache config: 
# Forward /test to index1.php
RewriteRule =test /test/index1.php [QSA,L]
# Forward /test/ to index2.php
RewriteRule =test/ /test/index2.php [QSA,L]
# Forward /completely/bogus/url and /completely/bogus/url/ to index3.php
RewriteRule ^completely/bogus/url/?$ /test/index3.php [QSA,L]
# Forward /everything and all URLs starting with /everything/ to index4.php
RewriteRule ^everything($|/) /test/index4.php [QSA,L]

ScotWatson said:
Any idea why fusio is getting a canceled request when he tries to go to the test endpoint? Do you get the same result?
Click to expand...
The canceled request in fusio’s screenshot originates from the client browser, not the server, so fusio has something wrong on his end that is aborting the connection (effectively clicking the stop loading button). It could be any of a wide variety of virus-scanning products that are inspecting web traffic or an extension that is installed in fusio’s browser, such as an ad blocker.
I am able to access your site without issue.
 
You must log in or register to reply here.
Top