2

The Apache documentation explains, how can we set up custom error pages for different HTTP errors, identified by their status code (401, 403, 404, 500, 503 and so on).

However, what this document says, is essentially this: in the case of an error, Apache generates an internal sub-request for a document.

For example, an

ErrorDocument 404 /errors/dunno.html
ErrorDocument 500 /errors/sux.html

lines will result that the documents /errors/dunno.html and /errors/sux.html will be served in the case of a 404 (file not found) or 500 (internal server) error.

However, it also means that a http request for https://my.server/errors/sux.html will serve that sux.html, as an ordinary file.

This is not what I want.

I want the error pages should live out of the DocumentRoot, and they should be totally unreachable with ordinary http queries. The only case, when they should be served, if Apache serves a (non-200) http answer which is affected by an ErrorDocument directive in its configuration.

Can I somehow do this?

  • I'm not sure you can do without an URL-path, but you might be able to use mod_rewrite's IS_SUBREQ condition or nosubreq flag to recognize the subrequest and treat it different from ordinary requests. (Note there might be subrequests in other circumstances, too) – Ulrich Schwarz Jul 14 '18 at 9:28
-1

Have you actually tested the ErrorDocument ? Two things that I noticed when I did it...

I tried setting up a fake URL based API where the 404 errordoc was my master API PHP script, which would then return the content after parsing the requested URL. Worked as normal in a browser and the URL displayed was the one requested, NOT the ErrorDocument.

However, AngularJS was complaining about the 404 status code even though the content of the message was the json that was requested.

So...

Apache and ErrorDocuments can/will display the requested URL, not the URL of the ErrorDocument. So unless they can guess your naming scheme, no direct access is possible.

The client is still sent a 404 or other appropriate HTTP status code, not a 200/OK.

Apache logs the request as a 404, showing the requested URL if configured to log that way.

Just tested on default install of apache2.4.x on both Debian and Ubuntu systems using default config other than adding an ErrorDocument 404 /test.html directive.

  • "I tried setting up a fake URL based API where the 404 errordoc was my master API PHP script," <- this sentence is incomprehensible for me. "AngularJS was complaining about the 404 status code" <- AngularJs is a client-only thing, what has to do about the server side? The rest of your answer is incomprehensible in the lack of understanding of these two. – peterh Jul 15 '18 at 15:42
  • @peterh - yes, Angular is client side. And you can communicate via HTTP to get data, etc. REST-like service on the apache/php side to spit out JSON based on URL path requested. Angular ignored that the content was correct, paid attention to the 404 response code. Changed it all to do a rewrite instead. Anyway, ignore that, and then read the rest of it... Or do what I did and actually fire up a VM, install Apache, and test it yourself. – ivanivan Jul 15 '18 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.