Apache 2.4 – htaccess RewriteEngine On Causes 403 Error

apache-2.4mod-rewritewindows-server-2022

Windows Server 2022
Apache 2.4.57 x64

httpd.conf – relevant

<Directory />
    Options none
    AllowOverride none
    Require all denied
</Directory>
DirectoryIndex index.html
<Files ".ht*">
    Require all denied
</Files>

httpd-vhosts.conf – relevant

<VirtualHost *:443>
    DocumentRoot "c:/path/to/public_html"
    DirectoryIndex index.php
    <Directory "c:/path/to/public_html">
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

files

c:/path/to/public_html/index.php
c:/path/to/public_html/.htaccess

.htaccess – full

RewriteEngine Off

When RewriteEngine Off then https://www.example.com/ serves index.php

When RewriteEngine On then https://www.example.com/ results in a 403-Forbidden

Am I missing some obvious directive?

Note: the behavior described above stays the same even if https://www.example.com/index.php is explicitly requested.

Best Answer

FIXED!

<VirtualHost *:443>
    DocumentRoot "c:/path/to/public_html"
    
    ## NEW
    RewriteEngine On
    
    DirectoryIndex index.php
    <Directory "c:/path/to/public_html">
        AllowOverride All
        Require all granted
        
        ## NEW
        Options +FollowSymlinks
        
    </Directory>
</VirtualHost>

Checking the logs revealed:

[rewrite:error] AH00670: Options FollowSymLinks and SymLinksIfOwnerMatch are both off, so the RewriteRule directive is also forbidden due to its similar ability to circumvent directory restrictions

RTFM'ing RewriteRule reveals:

To enable the rewrite engine in this context, you need to set "RewriteEngine On" and "Options FollowSymLinks" must be enabled.

Face, meet palm.

Related Topic