== Some notes on rewrites in Apache _.htaccess_ files

Since I keep rediscovering this every so often, here's what I know about
rewrite rules in _.htaccess_ files so that I can just read it here the
next time around.

Some basics:

* you need a '_RewriteEngine on_' statement, even if the rewrite engine
  is already on in the main configuration.

* the 'URLs' that you match against in _RewriteRule_ are relative to
  the directory the _.htaccess_ is in. However, Apache variables like
  ((%{REQUEST_FILENAME})) that you use in _RewriteCond_ are the full
  real URLs, not URLs relative to the directory. This makes sense,
  but does mean one has to keep track of it all.

Suppose that you want to have a 'directory' that is actually a CGI-BIN.
There are two ways to do this:

* make an actual directory, and put a _.htaccess_ in it that has:
	_RewriteRule ^(.*)$ /cgis/my-cgi/$1 [PT]_

  Apache itself will then handle generating a redirect for people
  who ask for the directory without the trailing slash; your CGI-BIN
  does not have to worry about it.

* put a _.htacces_ in the directory that is one level up. This should
  have something like:
	_RewriteRule ^foo$ /cgis/my-cgi [PT]_ \\
	_RewriteRule ^foo/(.*)$ /cgis/my-cgi/$1 [PT]_

  Your CGI will have to generate the redirect when people ask for the
  directory without the trailing slash (or, well, do whatever you want
  with their requests); Apache won't do anything special for you.

It is common to implement the latter approach with a single rewrite
rule:

> _RewriteRule ^foo(.*)$ /cgis/my-cgi/$1 [PT]_

However, this is incorrect because it matches too much; it will send
any URL in that directory that starts with _foo_ off to your CGI-BIN,
including things like a request for '_foobar_'.

(You may not care about this. I do, partly because I don't like
handing my CGIs URLs that they're not actually supposed to be
handling.)

PS: the very similar looking destination '_/cgis/my-cgi$1_' is very
much not what you want; in fact, I believe that it's a security risk,
as I think it means that Apache can be tricked into running things like
'_/cgis/my-cgi.old_' with a suitable request.