Allow only .json requests on apache server using .htaccess - php

I have an underdeveloped website which is live on the net now (need remote access). This site has both php/html output for human visitors and .json output for the API. Currently I want it this way that if a human visitor visits the site, he/she will be redirect to a coming soon page. but if the request contains .json, it will be delivered. Note: the json requests on the api looks like:
example.com/../..../example.json
example.com/../../example.json/all/etc
Is there any way using .htaccess I can achieve such functionality? Thanks

Not sure if this is what you're looking for, but in order to allow access only to URLs containing ".json", and show a coming_soon.htm page otherwise, use the following .htaccess:
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !.json
RewriteRule ^.* coming_soon.htm [L]

Related

redirect facebook app to canvas url if host url is hit directly

I have iframe based facebook app, I just want to do is that whenever someone hits the application url directly http://mysite.com must be redirect to my facebook canvas url for this app say http://apps.facebook.com/mysite. This seems pretty easy but unfortunately its not clicking in my mind
any help would be appreciated
EDIT
the application is in codeigniter
EDIT
htaccess
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php/$0 [PT,L]
php_value error_reporting 7
php_flag display_errors On
php_value auto_prepend_file prepend.php
say my domain is
http://abc.com/mysitefolder
my facebook app link is
http://apps.facebook.com/myappname
please consider http and https conversion too
also guyz one suggestion too as you see am using prepend in htaccess its just to get the user timezone for some date time stuff, is this fine am using it this way? the file actually sets a cookie for a user on very first visit to the site per session
Best Regards
Junaid
Any canvas page for an app that comes from Facebook will have $_REQUEST['signed_request'] defined. You could check for the existence of this request variable and if it is not set, redirect to Facebook.
well as far as i know there isn't any server side coding to do so... then again how could there be since it's all happening on the frontside of things what you could do is using javascript like so
if(window!=window.top){i am iframed now redirect or w/e you wanna do}
Since you want to redirect the domain name to the app, not the other way around, the fact that the app is in an iFrame isn't relevant.
The best way to do it is using .htaccess, in my opinion. This means that you can use custom URLs such as mydomainname.com/mypagename/, which would redirect to apps.facebook.com/myappname/mypagename/, so you can advertise your app easier. Another benefit is that you don't have to rely on Javascript. Some people (very small amount) have it turned off, but why parse all the PHP code to do it?
So, what you can do is have the root domain "blank" and only include the following in your .htaccess file:
RewriteEngine on
RewriteRule ^$ http://www.mydomainname.com/ [R=301,L,QSA]
RewriteRule ^/(.*) http://www.mydomainname.com/$1 [R=301,L,QSA]
QSA will also attach query parameters to the destination URL, such as "?ref=email".
Of course, if you keep the app code on the same domain, in the root, you don't really need to do anything, just tweak your authentification code.
If this doesn't work for you, please give us more details:
Where does the app "live"
If the app sits in the mydomainname.com, what happens when you access the URL directly?
How do you do the authentification?
Code helps, obviously.
Unless mydomainname.com isn't specific for the app, I'd recommend hosting the actual app on a subdomain. Actually, regardless, should help you organize. Or you might want to make the app accesibile as a website as well, with a Facebook login option.
Cheers

Special profile page link like www.domain.com/username

Hey guys I have a question. I wanna create a profile page for each new user, and I noticed that on facebook you could simply type in www.facebook.com/username and you get to the user's page, my question is, how can I do this without something like domain.com/users.php?useraname="username" or something like that? How can I simply make it like the facebook one?
What you are looking for is mod_rewrite. This will allow you to write PHP code that appears to the end user to be a directory on the server (such as www.facebook.com/user.php?username into www.facebook.com/username.)
An introduction to them with PHP can be found here: http://wettone.com/code/clean-urls
Please note you will need to enable it on your server. That should be possible in the .htaccess file if you're running an Apache server.
This is not a complete answer since I'm NOT a php guy
What you're looking for a RESTful urls, mostly you can get urls like that on your web app if you use a framework that supports restful urls
See this SO question:
REST-style URLS and PHP
See this article:
http://blog.garethj.com/2009/02/building-a-restful-web-application-with-php/
Search google and Search SO with google
This can’t be done with PHP alone. It’s the web server that needs to know how to handle these kind of request first.
Because, to put it simply, a web server just takes the requested and tries to map it onto a file in the file system below the document root directory. And if it can’t find an appropriate file, it returns an 404 error code.
Now there is some kind of URL rewriting mechanism for almost every web server software. In case of Apache as the most popular web server software out there, there is mod_rewrite that allows URL rewriting based on rules. In this case the following could enable /users.php?username=username being also accessible through /username:
RewriteEngin on
RewriteRule ^[a-z]+$ index.php?username=$0
Options +FollowSymLinks
RewriteEngine On
RewriteBase /php/profile
RewriteCond %{SCRIPT_FILENAME} !-d
RewriteCond %{SCRIPT_FILENAME} !-f
RewriteRule ^users/(.)$ ./profile.php
http://exapmle.com/users/waqar.alamgir
in $_SERVER['REQUEST_URI'] you will see users/waqar.alamgir

Redirecting image to php page

Is it possible to redirect a user to a php page and then redirect to different image, if the user is requesting for the image ?
For example if user requests for the image or if other website requests for the image, it should be redirected to the php page and then redirected to a different image.
Like if other website requests for http://example.com/images/a.gif, the website will get a different image i.e. http://example.com/images/b.gif.
Is it possible? Let me know if I am not clear with my problem.
Thanks.
Looks like a use case for mod rewrite
with something like:
RewriteRule /images/(.*).gif$ images.php?img=$1
Do you mean you want to redirect to a different image, if the request comes from outside your site? Then you need apache's mod_rewrite, and rules something like this:
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://your\.site\.com/ [NC]
RewriteRule a.gif b.gif [L,R]
It means: if the referer is not a part of your site, rewrite every request to a.gif to b.gif.
The RewriteRule specified above would be best, if you're using Apache. You could do it either via the server's config files or through a .htaccess rule if your server supports it. For more info, look to Apache's modrewrite page (for version 2.2): http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html
If you're using IIS or another web server, they all allow similar redirects, they just have different ways of implementing them.

How can I ensure my website always opens as www.mysite.com and not mysite.com - this messed up my Google OpenID logins?

my website has a log in by open id feature. When a user logs in for the first time using his/ her openid they are redirected to a create account page. I noticed just recently that one user when logged in using her google account created an account for the first time. However when she tried to log in again using the same google account - she was faced with creating a new account again. I checked the db and saw that although she used the same google account - the open ID urls which were retrieved are different?
EDIT===================
Thanks Kobi for the information - the issue is that I need to set up my website so it always opens with www prepended to it i.e. http://www.mysite.com and NOT http://mysite.com
Owing to this subtle difference google OpenID recognises the two urls as different urls!!! Help please
I realised its an htaccess thing however I googled a bit and found these htaccess commands:
RewriteCond %{HTTP_HOST} ^site.com [NC]
RewriteRule (.*) http://www.site.com/$1 [L,R=301]
However the problem is that when I use this in my htaccess it does forward and ensure the link reads as www.site.com however it messed up all the javascript links - actually I'm using url rewriting here as well... my whole htaccessfile is somewhat like this:
RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule .* index.php
RewriteRule !\.(js|ico|gif|jpg|png|css)$ index.php
AddType text/css .css
inclusion of the two lines messes up the url rewriting :( what do I do here
======================
Uh never mind I figured it out :) I was putting the two rewrite url lines at the end thus somehow overriding the other rewrite rules - putting them in the beginning fixed it :) thanks anyway
Google gives different URLs for different domains.
It is possible your user used a different URL each time to log in? Even www on the start of the url can change the code Google returns.

How to log every single access to my website with 2 different domains

I have two different domains that both point to my homepage in the same server.
I want to log every single access made to my homepage and log which domain the user used to access my homepage, how can I do this?
I tried mod_rewrite in Apache and logging to a MySQL database with PHP but all I could do was infinite loops.
Any ideas?
EDIT:
By your answers, I see you didn't get what I want...
As far as I know Google Analytics does not allow me to differentiate the domain being used if they both point to the same site and it also does not allow me to see that some files like images were accessed directly instead of through my webpages.
I can't also just use $_SERVER['HTTP_HOST'] cause like I just said, I want to log EVERYTHING, like images and all other files, every single request, even if it doesn't exist.
As for Webalizer, I never saw it differentiate between domains, it always assumes the default domain configure in the account and use that as root, it doesn't even display it. I'll have to check it again, but I'm not sure it will do what I want...
INFINITE LOOP:
The approach I tried involved rewriting the urls in Apche with a simple Rewrite rule pointing to a PHP script, the PHP script would log the entry into a MySQL database and the send the user back to the file with the header() function. Something like this:
.htaccess:
RewriteCond %{HTTP_HOST} ^(www\.)?domain1\.net [NC]
RewriteRule ^(.*)$ http://www.domain1.net/logscript?a=$1 [NC,L]
RewriteCond %{HTTP_HOST} ^(www\.)?domain2\.net [NC]
RewriteRule ^(.*)$ http://www.domain2.net/logscript?a=$1 [NC,L]
PHP Script:
$url = $_GET['a'];
$domain = $_SERVER['HTTP_HOST'];
// Code to log the entry into the MySQL database
header("Location: http://$domain/$url");
exit();
So, I access some file, point that file to the PHP script and the script will log and redirect to that file... However, when PHP redirects to that file, the htaccess rules will pick it up and redirect again too the PHP script, creating an infinite loop.
The best thing do would be to parse the server logs. Those will show the domain and request. Even most shared hosting accounts provide access to the logs.
If you're going to go the rewrite route, you could use RewriteCond to check the HTTP_REFERER value to see if the referer was a local link or not.
RewriteCond %{HTTP_HOST} ^(www\.)?domain1\.net [NC]
RewriteCond %{HTTP_REFERER} !^(.*)domain1(.*)$ [NC]
RewriteRule ^(.*)$ http://www.domain1.net/logscript?a=$1 [NC,L]
RewriteCond %{HTTP_HOST} ^(.*)domain2\.net [NC]
RewriteCond %{HTTP_REFERER} !^(.*)domain2(.*)$ [NC]
RewriteRule ^(.*)$ http://www.domain2.net/logscript?a=$1 [NC,L]
You may also want to post in the mod_rewrite forum. They have a whole section about handling domains.
If Google Analytics is not your thing,
$_SERVER['HTTP_HOST']
holds the domain that is used, you can log that (along with time, browser, filepath etc). No need for mod_rewrite I think. Check print_r($_SERVER) to see other things that might be interesting to log.
Make sure to still escape (mysql_real_escape_string()) all the log values, it's trivially easy to inject SQL via the browser's user-agent string for example.
So, I access some file, point that file to the PHP script and the script will log and redirect to that file... However, when PHP redirects to that file, the htaccess rules will pick it up and redirect again too the PHP script, creating an infinite loop.
Can you check for HTTP headers in the RewriteCond? If so, try setting an extra header alongside the redirect in PHP (by convention custom HTTP headers start with 'X-' so it could be header('X-stayhere: 1');), and if the X-stayhere header is present, the RewriteCond fails and it doesn't forward the browser to the PHP script.
If, however, you can cron a script to download the server logs and run them through some freeware logfile analyzer, I'd go with that instead. Having two redirects for every request is a fair bit of overhead.. (and if I was more awake I might be able to come up with different solutions)
Does Google Analytics not provide this option? Or could you not parse your server log files?
Why not use the access log facility build in apache?
Apache have a "piped log" function that allow you redirect the access log to any program.
CustomLog "|/path/to/your/logger" common

Categories