| <!DOCTYPE html SYSTEM "about:legacy-compat"> | |
| <html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"> | |
| <meta content="width=device-width, initial-scale=1" name="viewport"> | |
| <!-- | |
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | |
| This file is generated from xml source: DO NOT EDIT | |
| XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX | |
| --> | |
| <title>Environment Variables in Apache httpd - Apache HTTP Server Version 2.5</title> | |
| <link href="./style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet"> | |
| <link href="./style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size"> | |
| <link href="./style/css/manual-print.css" rel="stylesheet" media="print" type="text/css"><link rel="stylesheet" type="text/css" href="./style/css/prettify.css"> | |
| <script src="./style/scripts/prettify.min.js"> | |
| </script> | |
| <link href="./images/favicon.png" rel="shortcut icon"></head> | |
| <body id="manual-page"><div id="page-header"> | |
| <p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/quickreference.html">Directives</a> | <a href="https://cwiki.apache.org/confluence/display/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a> | <a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2">Report a bug</a></p> | |
| <p class="apache">Apache HTTP Server Version 2.5</p> | |
| <img alt="" src="./images/feather.png"></div> | |
| <div class="up"><a href="./"><img title="<-" alt="<-" src="./images/left.gif"></a></div> | |
| <div id="path"> | |
| <a href="https://www.apache.org/">Apache</a> > <a href="https://httpd.apache.org/">HTTP Server</a> > <a href="https://httpd.apache.org/docs/">Documentation</a> > <a href="./">Version 2.5</a></div><div id="page-content"><div id="preamble"><h1>Environment Variables in Apache httpd</h1> | |
| <button aria-label="Toggle language list" class="lang-toggle"><svg xmlns="http://www.w3.org/2000/svg" stroke-width="2" stroke="currentColor" fill="none" viewBox="0 0 24 24" height="16" width="16"><circle r="10" cy="12" cx="12"/><line y2="12" x2="22" y1="12" x1="2"/><path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"/></svg></button> | |
| <div class="toplang"> | |
| <p><span>Available Languages: </span><a href="./en/env.html" title="English"> en </a> | | |
| <a href="./fr/env.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | | |
| <a href="./ja/env.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | | |
| <a href="./ko/env.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | | |
| <a href="./tr/env.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> | |
| </div> | |
| <p>There are two kinds of environment variables that affect | |
| the Apache HTTP Server.</p> | |
| <p>First, there are the environment variables controlled by | |
| the underlying operating system. These are set before the | |
| server starts. They can be used in expansions in configuration | |
| files, and can optionally be passed to CGI scripts and SSI | |
| using the PassEnv directive.</p> | |
| <p>Second, the Apache HTTP Server provides a mechanism for storing | |
| information in named variables that are also called <em>environment | |
| variables</em>. This information can be used to control various | |
| operations such as logging or access control. The variables are | |
| also used as a mechanism to communicate with external programs | |
| such as CGI scripts. This document discusses different ways to | |
| manipulate and use these variables.</p> | |
| <p>Although these variables are referred to as <em>environment | |
| variables</em>, they are not the same as the environment | |
| variables controlled by the underlying operating system. | |
| Instead, these variables are stored and manipulated in an | |
| internal httpd structure. They only become actual operating | |
| system environment variables when they are provided to CGI | |
| scripts and Server Side Include scripts. If you wish to | |
| manipulate the operating system environment under which the | |
| server itself runs, you must use the standard environment | |
| manipulation mechanisms provided by your operating system | |
| shell.</p> | |
| </div> | |
| <div id="quickview"><ul id="toc"><li><img alt="" src="./images/down.gif"> <a href="#setting">Setting Environment Variables</a></li> | |
| <li><img alt="" src="./images/down.gif"> <a href="#using">Using Environment Variables</a></li> | |
| <li><img alt="" src="./images/down.gif"> <a href="#cgi">CGI environment variables</a></li> | |
| <li><img alt="" src="./images/down.gif"> <a href="#special">Special Purpose Environment Variables</a></li> | |
| <li><img alt="" src="./images/down.gif"> <a href="#redirect-vars">REDIRECT_ variables</a></li> | |
| <li><img alt="" src="./images/down.gif"> <a href="#examples">Examples</a></li> | |
| </ul></div> | |
| <div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="setting">Setting Environment Variables <a title="Permanent link" href="#setting" class="permalink">¶</a></h2> | |
| <table class="related"><tr><th>Related Modules</th><th>Related Directives</th></tr><tr><td><ul><li><code class="module"><a href="./mod/mod_cache.html">mod_cache</a></code></li><li><code class="module"><a href="./mod/mod_env.html">mod_env</a></code></li><li><code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code></li><li><code class="module"><a href="./mod/mod_setenvif.html">mod_setenvif</a></code></li><li><code class="module"><a href="./mod/mod_unique_id.html">mod_unique_id</a></code></li></ul></td><td><ul><li><code class="directive"><a href="./mod/mod_setenvif.html#browsermatch">BrowserMatch</a></code></li><li><code class="directive"><a href="./mod/mod_setenvif.html#browsermatchnocase">BrowserMatchNoCase</a></code></li><li><code class="directive"><a href="./mod/mod_env.html#passenv">PassEnv</a></code></li><li><code class="directive"><a href="./mod/mod_rewrite.html#rewriterule">RewriteRule</a></code></li><li><code class="directive"><a href="./mod/mod_env.html#setenv">SetEnv</a></code></li><li><code class="directive"><a href="./mod/mod_setenvif.html#setenvif">SetEnvIf</a></code></li><li><code class="directive"><a href="./mod/mod_setenvif.html#setenvifnocase">SetEnvIfNoCase</a></code></li><li><code class="directive"><a href="./mod/mod_env.html#unsetenv">UnsetEnv</a></code></li></ul></td></tr></table> | |
| <h3 id="basic-manipulation">Basic Environment Manipulation</h3> | |
| <p>The most basic way to set an environment variable in Apache | |
| is using the unconditional <code class="directive"><a href="./mod/mod_env.html#setenv">SetEnv</a></code> directive. Variables may also be passed from | |
| the environment of the shell which started the server using the | |
| <code class="directive"><a href="./mod/mod_env.html#passenv">PassEnv</a></code> directive.</p> | |
| <h3 id="conditional">Conditional Per-Request Settings</h3> | |
| <p>For additional flexibility, the directives provided by | |
| <code class="module"><a href="./mod/mod_setenvif.html">mod_setenvif</a></code> allow environment variables to be set | |
| on a per-request basis, conditional on characteristics of particular | |
| requests. For example, a variable could be set only when a | |
| specific browser (User-Agent) is making a request, or only when | |
| a specific Referer [sic] header is found. Even more flexibility | |
| is available through the <code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code>'s <code class="directive"><a href="./mod/mod_rewrite.html#rewriterule">RewriteRule</a></code> which uses the | |
| <code>[E=...]</code> option to set environment variables.</p> | |
| <h3 id="unique-identifiers">Unique Identifiers</h3> | |
| <p>Finally, <code class="module"><a href="./mod/mod_unique_id.html">mod_unique_id</a></code> sets the environment | |
| variable <code>UNIQUE_ID</code> for each request to a value which is | |
| guaranteed to be unique across "all" requests under very | |
| specific conditions.</p> | |
| <h3 id="standard-cgi">Standard CGI Variables</h3> | |
| <p>In addition to all environment variables set within the | |
| Apache configuration and passed from the shell, CGI scripts and | |
| SSI pages are provided with a set of environment variables | |
| containing meta-information about the request as required by | |
| the CGI specification (<a href="https://www.rfc-editor.org/rfc/rfc3875">RFC 3875</a>).</p> | |
| <h3 id="caveats">Some Caveats</h3> | |
| <ul> | |
| <li>It is not possible to override or change the standard CGI | |
| variables using the environment manipulation directives.</li> | |
| <li>When <code class="program"><a href="./programs/suexec.html">suexec</a></code> is used to launch | |
| CGI scripts, the environment will be cleaned down to a set of | |
| <em>safe</em> variables before CGI scripts are launched. The | |
| list of <em>safe</em> variables is defined at compile-time in | |
| <code>suexec.c</code>.</li> | |
| <li>For portability reasons, the names of environment | |
| variables may contain only letters, numbers, and the | |
| underscore character. In addition, the first character may | |
| not be a number. Characters which do not match this | |
| restriction will be replaced by an underscore when passed to | |
| CGI scripts and SSI pages.</li> | |
| <li>A special case are HTTP headers which are passed to CGI | |
| scripts and the like via environment variables (see below). | |
| They are converted to uppercase and only dashes are replaced with | |
| underscores; if the header contains any other (invalid) character, | |
| the whole header is silently dropped. See <a href="#fixheader"> | |
| below</a> for a workaround.</li> | |
| <li>The <code class="directive"><a href="./mod/mod_env.html#setenv">SetEnv</a></code> directive runs | |
| late during request processing meaning that directives such as | |
| <code class="directive"><a href="./mod/mod_setenvif.html#setenvif">SetEnvIf</a></code> and <code class="directive"><a href="./mod/mod_rewrite.html#rewritecond">RewriteCond</a></code> will not see the | |
| variables set with it.</li> | |
| <li>When the server looks up a path via an internal | |
| <a class="glossarylink" href="./glossary.html#subrequest" title="see glossary">subrequest</a> such as looking | |
| for a <code class="directive"><a href="./mod/mod_dir.html#directoryindex">DirectoryIndex</a></code> | |
| or generating a directory listing with <code class="module"><a href="./mod/mod_autoindex.html">mod_autoindex</a></code>, | |
| per-request environment variables are <em>not</em> inherited in the | |
| subrequest. Additionally, | |
| <code class="directive"><a href="./mod/mod_setenvif.html#setenvif">SetEnvIf</a></code> directives | |
| are not separately evaluated in the subrequest due to the API phases | |
| <code class="module"><a href="./mod/mod_setenvif.html">mod_setenvif</a></code> takes action in.</li> | |
| </ul> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="using">Using Environment Variables <a title="Permanent link" href="#using" class="permalink">¶</a></h2> | |
| <table class="related"><tr><th>Related Modules</th><th>Related Directives</th></tr><tr><td><ul><li><code class="module"><a href="./mod/mod_authz_host.html">mod_authz_host</a></code></li><li><code class="module"><a href="./mod/mod_cgi.html">mod_cgi</a></code></li><li><code class="module"><a href="./mod/mod_ext_filter.html">mod_ext_filter</a></code></li><li><code class="module"><a href="./mod/mod_headers.html">mod_headers</a></code></li><li><code class="module"><a href="./mod/mod_include.html">mod_include</a></code></li><li><code class="module"><a href="./mod/mod_log_config.html">mod_log_config</a></code></li><li><code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code></li></ul></td><td><ul><li><code class="directive"><a href="./mod/mod_authz_core.html#require">Require</a></code></li><li><code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code></li><li><code class="directive"><a href="./mod/mod_access_compat.html#allow">Allow</a></code></li><li><code class="directive"><a href="./mod/mod_access_compat.html#deny">Deny</a></code></li><li><code class="directive"><a href="./mod/mod_ext_filter.html#extfilterdefine">ExtFilterDefine</a></code></li><li><code class="directive"><a href="./mod/mod_headers.html#header">Header</a></code></li><li><code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code></li><li><code class="directive"><a href="./mod/mod_rewrite.html#rewritecond">RewriteCond</a></code></li><li><code class="directive"><a href="./mod/mod_rewrite.html#rewriterule">RewriteRule</a></code></li></ul></td></tr></table> | |
| <div class="note"> | |
| <h3>Modern alternative: Expressions</h3> | |
| <p>Many use cases that previously required setting and testing | |
| environment variables — including conditional headers, access | |
| control, and logging — can now be handled more directly using | |
| <code class="directive"><a href="./mod/core.html#if"><If></a></code> expressions | |
| with the <code>reqenv</code> function. See | |
| <a href="expr.html">Expressions in Apache HTTP Server</a> for the | |
| expression syntax and the full list of available | |
| <a href="expr.html#vars">variables</a>.</p> | |
| </div> | |
| <h3 id="cgi-scripts">CGI Scripts</h3> | |
| <p>One of the primary uses of environment variables is to | |
| communicate information to CGI scripts. As discussed above, the | |
| environment passed to CGI scripts includes standard | |
| meta-information about the request in addition to any variables | |
| set within the Apache configuration. For more details, see the | |
| <a href="howto/cgi.html">CGI tutorial</a>.</p> | |
| <h3 id="ssi-pages">SSI Pages</h3> | |
| <p>Server-parsed (SSI) documents processed by | |
| <code class="module"><a href="./mod/mod_include.html">mod_include</a></code>'s | |
| <code>INCLUDES</code> filter can print environment variables | |
| using the <code>echo</code> element, and can use environment | |
| variables in flow control elements to makes parts of a page | |
| conditional on characteristics of a request. Apache also | |
| provides SSI pages with the standard CGI environment variables | |
| as discussed above. For more details, see the <a href="howto/ssi.html">SSI tutorial</a>.</p> | |
| <h3 id="access-control">Access Control</h3> | |
| <p>Access to the server can be controlled based on | |
| environment variables using the <code>Require env</code> | |
| and <code>Require not env</code> directives. In combination with | |
| <code class="directive"><a href="./mod/mod_setenvif.html#setenvif">SetEnvIf</a></code>, this | |
| allows for flexible control of access to the server based on | |
| characteristics of the client. For example, you can use these | |
| directives to deny access to a particular browser (User-Agent). | |
| For more complex conditions, | |
| <a href="expr.html"><code>Require expr</code></a> provides | |
| an alternative that can evaluate environment variables using | |
| the <code>reqenv</code> function alongside other request properties. | |
| </p> | |
| <h3 id="logging">Conditional Logging</h3> | |
| <p>Environment variables can be logged in the access log using | |
| the <code class="directive"><a href="./mod/mod_log_config.html#logformat">LogFormat</a></code> | |
| option <code>%e</code>. In addition, the decision on whether | |
| or not to log requests can be made based on the status of | |
| environment variables using the conditional form of the | |
| <code class="directive"><a href="./mod/mod_log_config.html#customlog">CustomLog</a></code> | |
| directive. In combination with <code class="directive"><a href="./mod/mod_setenvif.html#setenvif">SetEnvIf</a></code> this allows for flexible control of which | |
| requests are logged. For example, you can choose not to log | |
| requests for filenames ending in <code>gif</code>, or you can | |
| choose to only log requests from clients which are outside your | |
| subnet.</p> | |
| <h3 id="response-headers">Conditional Response Headers</h3> | |
| <p>The <code class="directive"><a href="./mod/mod_headers.html#header">Header</a></code> | |
| directive can use the presence or | |
| absence of an environment variable to determine whether or not | |
| a certain HTTP header will be placed in the response to the | |
| client. This allows, for example, a certain response header to | |
| be sent only if a corresponding header is received in the | |
| request from the client.</p> | |
| <h3 id="external-filter">External Filter Activation</h3> | |
| <p>External filters configured by <code class="module"><a href="./mod/mod_ext_filter.html">mod_ext_filter</a></code> | |
| using the <code class="directive"><a href="./mod/mod_ext_filter.html#extfilterdefine">ExtFilterDefine</a></code> directive can | |
| by activated conditional on an environment variable using the | |
| <code>disableenv=</code> and <code>enableenv=</code> options.</p> | |
| <h3 id="url-rewriting">URL Rewriting</h3> | |
| <p>The <code>%{ENV:<em>variable</em>}</code> form of | |
| <em>TestString</em> in the <code class="directive"><a href="./mod/mod_rewrite.html#rewritecond">RewriteCond</a></code> allows <code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code>'s rewrite | |
| engine to make decisions conditional on environment variables. | |
| Note that the variables accessible in <code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code> | |
| without the <code>ENV:</code> prefix are not actually environment | |
| variables. Rather, they are variables special to | |
| <code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code> which cannot be accessed from other | |
| modules.</p> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="cgi">CGI environment variables <a title="Permanent link" href="#cgi" class="permalink">¶</a></h2> | |
| <p>The CGI specification (<a href="https://www.rfc-editor.org/rfc/rfc3875#section-4.1">RFC 3875</a>) defines a | |
| number of meta-variables, many of which derive their values from | |
| HTTP request headers. Apache httpd makes these available as | |
| environment variables to CGI scripts and other request-processing | |
| mechanisms. These have been adopted more broadly, and are a standard | |
| part of passing information between the browser and the | |
| server, and between processes on the server side. Here we | |
| discuss a few of these. For the complete list of request | |
| variables available in <a href="expr.html">expressions</a> | |
| (including <code>REQUEST_URI</code>, <code>REMOTE_ADDR</code>, | |
| <code>SERVER_NAME</code>, and many others), see the | |
| <a href="expr.html#vars">expression variables</a> reference.</p> | |
| <p>Refer to the CGI spec for further details of the standard | |
| CGI meta-variables.</p> | |
| <h3 id="query-string">QUERY_STRING</h3> | |
| <p>The <code>QUERY_STRING</code> variable is set to | |
| anything that appears after a question mark (?) at the | |
| end of a requested URL. This is used to pass | |
| information to the server, and may be divided into | |
| key/value pairs. The string should be | |
| URL-encoded.</p> | |
| <div class="example"><p><code> | |
| https://example.com/path/resource.php?key1=value1&key2=another%20value | |
| </code></p></div> | |
| <p>In the example here, the variable | |
| <code>QUERY_STRING</code> is set to everything | |
| following the ?, and the receiving application (e.g. | |
| CGI or a PHP script, perhaps) is responsible for | |
| parsing the key/value pairs.</p> | |
| <h3 id="path-info">PATH_INFO</h3> | |
| <p>The variable <a class="glossarylink" href="./glossary.html#pathinfo" title="see glossary">PATH_INFO</a> is set to | |
| the any value that appears after a matches resource | |
| at the end of the URL, not including any | |
| <code>QUERY_STRING</code>. This is best shown by | |
| an example:</p> | |
| <div class="example"><p><code> | |
| https://example.com/resource.php/additional/data?key1=value1 | |
| </code></p></div> | |
| <p>In the example shown, | |
| <code>PATH_INFO</code> will be set to | |
| <code>/additional/data</code> and | |
| <code>QUERY_STRING</code> will be set to | |
| <code>key1=value1</code>.</p> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="special">Special Purpose Environment Variables <a title="Permanent link" href="#special" class="permalink">¶</a></h2> | |
| <p>Interoperability problems have led to the introduction of | |
| mechanisms to modify the way Apache behaves when talking to | |
| particular clients. To make these mechanisms as flexible as | |
| possible, they are invoked by defining environment variables, | |
| typically with <code class="directive"><a href="./mod/mod_setenvif.html#browsermatch">BrowserMatch</a></code>, though <code class="directive"><a href="./mod/mod_env.html#setenv">SetEnv</a></code> and <code class="directive"><a href="./mod/mod_env.html#passenv">PassEnv</a></code> could also be used, for example.</p> | |
| <h3 id="downgrade">downgrade-1.0</h3> | |
| <p>This forces the request to be treated as a HTTP/1.0 request | |
| even if it was in a later dialect.</p> | |
| <h3 id="force-gzip">force-gzip</h3> | |
| <p>If you have the <code>DEFLATE</code> filter activated, this | |
| environment variable will ignore the accept-encoding setting of | |
| your browser and will send compressed output unconditionally.</p> | |
| <h3 id="force-no-vary">force-no-vary</h3> | |
| <p>This causes any <code>Vary</code> fields to be removed from | |
| the response header before it is sent back to the client. Some | |
| clients don't interpret this field correctly; setting this | |
| variable can work around this problem. Setting this variable | |
| also implies <strong>force-response-1.0</strong>.</p> | |
| <h3 id="force-response">force-response-1.0</h3> | |
| <p>This forces an HTTP/1.0 response to clients making an HTTP/1.0 | |
| request. It was originally | |
| implemented as a result of a problem with AOL's proxies. Some | |
| HTTP/1.0 clients may not behave correctly when given an HTTP/1.1 | |
| response, and this can be used to interoperate with them.</p> | |
| <h3 id="gzip-only-text-html">gzip-only-text/html</h3> | |
| <p>When set to a value of "1", this variable disables the | |
| <code>DEFLATE</code> output filter provided by | |
| <code class="module"><a href="./mod/mod_deflate.html">mod_deflate</a></code> for content-types other than | |
| <code>text/html</code>. If you'd rather | |
| use statically compressed files, <code class="module"><a href="./mod/mod_negotiation.html">mod_negotiation</a></code> | |
| evaluates the variable as well (not only for gzip, but for all | |
| encodings that differ from "identity").</p> | |
| <h3 id="no-gzip">no-gzip</h3> | |
| <p>When set, the <code>DEFLATE</code> filter of | |
| <code class="module"><a href="./mod/mod_deflate.html">mod_deflate</a></code> will be turned off and | |
| <code class="module"><a href="./mod/mod_negotiation.html">mod_negotiation</a></code> will refuse to deliver encoded | |
| resources.</p> | |
| <h3 id="no-cache">no-cache</h3> | |
| <p><em>Available in versions 2.2.12 and later</em></p> | |
| <p>When set, <code class="module"><a href="./mod/mod_cache.html">mod_cache</a></code> will not save an otherwise | |
| cacheable response. This environment variable does not influence | |
| whether a response already in the cache will be served for the current | |
| request.</p> | |
| <h3 id="nokeepalive">nokeepalive</h3> | |
| <p>This disables <code class="directive"><a href="./mod/core.html#keepalive">KeepAlive</a></code> | |
| when set.</p> | |
| <h3 id="prefer-language">prefer-language</h3> | |
| <p>This influences <code class="module"><a href="./mod/mod_negotiation.html">mod_negotiation</a></code>'s behavior. If | |
| it contains a language tag (such as <code>en</code>, <code>ja</code> | |
| or <code>x-klingon</code>), <code class="module"><a href="./mod/mod_negotiation.html">mod_negotiation</a></code> tries | |
| to deliver a variant with that language. If there's no such variant, | |
| the normal <a href="content-negotiation.html">negotiation</a> process | |
| applies.</p> | |
| <h3 id="redirect-carefully">redirect-carefully</h3> | |
| <p>This forces the server to be more careful when sending a redirect | |
| to the client. This is typically used when a client has a known | |
| problem handling redirects. This was originally implemented as a | |
| result of a problem with Microsoft's WebFolders software which has | |
| a problem handling redirects on directory resources via DAV | |
| methods.</p> | |
| <h3 id="suppress-error-charset">suppress-error-charset</h3> | |
| <p>When Apache issues a redirect in response to a client request, | |
| the response includes some actual text to be displayed in case | |
| the client can't (or doesn't) automatically follow the redirection. | |
| Apache ordinarily labels this text according to the character set | |
| which it uses, which is ISO-8859-1.</p> | |
| <p> However, if the redirection is to a page that uses a different | |
| character set, some broken browser versions will try to use the | |
| character set from the redirection text rather than the actual page. | |
| This can result in Greek, for instance, being incorrectly rendered.</p> | |
| <p>Setting this environment variable causes Apache to omit the character | |
| set for the redirection text, and these broken browsers will then correctly | |
| use that of the destination page.</p> | |
| <div class="warning"> | |
| <h3>Security note</h3> | |
| <p>Sending error pages without a specified character set may | |
| allow a cross-site-scripting attack for existing browsers (MSIE) | |
| which do not follow the HTTP/1.1 specification and attempt to | |
| "guess" the character set from the content. Such browsers can | |
| be easily fooled into using the UTF-7 character set, and UTF-7 | |
| content from input data (such as the request-URI) will not be | |
| escaped by the usual escaping mechanisms designed to prevent | |
| cross-site-scripting attacks.</p> | |
| </div> | |
| <h3 id="proxy">force-proxy-request-1.0, proxy-nokeepalive, proxy-sendchunked, | |
| proxy-sendcl, proxy-chain-auth, proxy-interim-response, proxy-initial-not-pooled</h3> | |
| <p>These directives alter the protocol behavior of | |
| <code class="module"><a href="./mod/mod_proxy.html">mod_proxy</a></code>. See the <code class="module"><a href="./mod/mod_proxy.html">mod_proxy</a></code> and <code class="module"><a href="./mod/mod_proxy_http.html">mod_proxy_http</a></code> | |
| documentation for more details.</p> | |
| <h3 id="cgilike">ap_trust_cgilike_cl</h3> | |
| <p><em>Available in 2.4.59 and later</em></p> | |
| <p> This variable allows a script running in CGI-like module to supply its | |
| own Content-Length HTTP response header. It should | |
| only be set on configuration sections that contain trusted scripts. | |
| </p> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="redirect-vars">REDIRECT_ variables <a title="Permanent link" href="#redirect-vars" class="permalink">¶</a></h2> | |
| <p>When an internal redirect occurs — whether from an | |
| <code class="directive"><a href="./mod/core.html#errordocument">ErrorDocument</a></code>, | |
| <code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code>, | |
| <code class="directive"><a href="./mod/mod_dir.html#fallbackresource">FallbackResource</a></code>, or | |
| any other internal redirect mechanism — the environment | |
| variables from the original request are made available to the | |
| redirect target with a <code>REDIRECT_</code> prefix.</p> | |
| <p>Two additional variables are always set:</p> | |
| <dl> | |
| <dt><code>REDIRECT_URL</code></dt> | |
| <dd>The URL-path of the original request before the internal | |
| redirect. This is set by the core server, not by any specific | |
| module.</dd> | |
| <dt><code>REDIRECT_STATUS</code></dt> | |
| <dd>The HTTP status code that triggered the redirect. For | |
| error documents this is the error status (e.g., 404). For | |
| internal redirects from <code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code> or | |
| <code class="directive"><a href="./mod/mod_dir.html#fallbackresource">FallbackResource</a></code>, | |
| this is typically 200.</dd> | |
| </dl> | |
| <p>For example, if <code>REQUEST_URI</code> was | |
| <code>/original/path</code> and an internal redirect sends the | |
| request to <code>/handler.php</code>, then the redirect target | |
| will see <code>REDIRECT_URL=/original/path</code> and | |
| <code>REQUEST_URI=/handler.php</code>.</p> | |
| <p>These variables are available to CGI scripts, SSI pages, and | |
| in <a href="expr.html">expressions</a>. For more information | |
| about REDIRECT_ variables in the context of error documents, | |
| see <a href="custom-error.html">Custom Error Responses</a>.</p> | |
| <p>This renaming is especially relevant when using | |
| <code class="module"><a href="./mod/mod_rewrite.html">mod_rewrite</a></code>'s | |
| <a href="rewrite/flags.html#flag_e">[E] flag</a> to set variables, | |
| since per-directory rewrites always trigger an internal redirect. | |
| See that section for examples and workarounds.</p> | |
| </div><div class="top"><a href="#page-header"><img alt="top" src="./images/up.gif"></a></div> | |
| <div class="section"> | |
| <h2 id="examples">Examples <a title="Permanent link" href="#examples" class="permalink">¶</a></h2> | |
| <h3 id="fixheader">Passing broken headers to CGI scripts</h3> | |
| <p>Starting with version 2.4, Apache is more strict about how HTTP | |
| headers are converted to environment variables in <code class="module"><a href="./mod/mod_cgi.html">mod_cgi | |
| </a></code> and other modules: Previously any invalid characters | |
| in header names were simply translated to underscores. This allowed | |
| for some potential cross-site-scripting attacks via header injection.</p> | |
| <p>If you have to support a client which sends broken headers and | |
| which can't be fixed, a simple workaround involving <code class="module"><a href="./mod/mod_setenvif.html">mod_setenvif | |
| </a></code> and <code class="module"><a href="./mod/mod_headers.html">mod_headers</a></code> allows you to still accept | |
| these headers:</p> | |
| <pre class="prettyprint lang-config"># | |
| # The following works around a client sending a broken Accept_Encoding | |
| # header. | |
| # | |
| SetEnvIfNoCase ^Accept.Encoding$ ^(.*)$ fix_accept_encoding=$1 | |
| RequestHeader set Accept-Encoding %{fix_accept_encoding}e env=fix_accept_encoding</pre> | |
| <h3 id="misbehaving">Changing protocol behavior with misbehaving clients</h3> | |
| <p>Earlier versions recommended that the following lines be included in | |
| httpd.conf to deal with known client problems. Since the affected clients | |
| are no longer seen in the wild, this configuration is likely no-longer | |
| necessary.</p> | |
| <pre class="prettyprint lang-config"># | |
| # The following directives modify normal HTTP response behavior. | |
| # The first directive disables keepalive for Netscape 2.x and browsers that | |
| # spoof it. There are known problems with these browser implementations. | |
| # The second directive is for Microsoft Internet Explorer 4.0b2 | |
| # which has a broken HTTP/1.1 implementation and does not properly | |
| # support keepalive when it is used on 301 or 302 (redirect) responses. | |
| # | |
| BrowserMatch "Mozilla/2" nokeepalive | |
| BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0 | |
| # | |
| # The following directive disables HTTP/1.1 responses to browsers which | |
| # are in violation of the HTTP/1.0 spec by not being able to understand a | |
| # basic 1.1 response. | |
| # | |
| BrowserMatch "RealPlayer 4\.0" force-response-1.0 | |
| BrowserMatch "Java/1\.0" force-response-1.0 | |
| BrowserMatch "JDK/1\.0" force-response-1.0</pre> | |
| <h3 id="no-img-log">Do not log requests for images in the access log</h3> | |
| <p>This example keeps requests for images from appearing in the | |
| access log. It can be easily modified to prevent logging of | |
| particular directories, or to prevent logging of requests | |
| coming from particular hosts.</p> | |
| <pre class="prettyprint lang-config">SetEnvIf Request_URI \.gif image-request | |
| SetEnvIf Request_URI \.jpg image-request | |
| SetEnvIf Request_URI \.png image-request | |
| CustomLog "logs/access_log" common env=!image-request</pre> | |
| <h3 id="image-theft">Prevent "Image Theft"</h3> | |
| <p>This example shows how to keep people not on your server | |
| from using images on your server as inline-images on their | |
| pages. This is not a recommended configuration, but it can work | |
| in limited circumstances. We assume that all your images are in | |
| a directory called <code>/web/images</code>.</p> | |
| <pre class="prettyprint lang-config">SetEnvIf Referer "^http://www\.example\.com/" local_referal | |
| # Allow browsers that do not send Referer info | |
| SetEnvIf Referer "^$" local_referal | |
| <Directory "/web/images"> | |
| Require env local_referal | |
| </Directory></pre> | |
| <p>For more information about this technique, see the | |
| "<a href="https://www.serverwatch.com/guides/keeping-your-images-from-adorning-other-sites/">Keeping Your Images from Adorning Other Sites</a>" | |
| tutorial on ServerWatch.</p> | |
| </div></div> | |
| <div class="bottomlang"> | |
| <p><span>Available Languages: </span><a href="./en/env.html" title="English"> en </a> | | |
| <a href="./fr/env.html" hreflang="fr" rel="alternate" title="Français"> fr </a> | | |
| <a href="./ja/env.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> | | |
| <a href="./ko/env.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> | | |
| <a href="./tr/env.html" hreflang="tr" rel="alternate" title="Türkçe"> tr </a></p> | |
| </div><div id="footer"> | |
| <p class="apache">Copyright 2026 The Apache Software Foundation.<br>Licensed under the <a href="https://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p> | |
| <p class="menu"><a href="./mod/">Modules</a> | <a href="./mod/quickreference.html">Directives</a> | <a href="https://cwiki.apache.org/confluence/display/httpd/FAQ">FAQ</a> | <a href="./glossary.html">Glossary</a> | <a href="./sitemap.html">Sitemap</a> | <a href="https://bz.apache.org/bugzilla/enter_bug.cgi?product=Apache%20httpd-2">Report a bug</a></p></div><script><!--//--><![CDATA[//><!-- | |
| if (typeof(prettyPrint) !== 'undefined') { | |
| prettyPrint(); | |
| } | |
| var langToggle = document.querySelector('.lang-toggle'); | |
| var topLang = document.querySelector('.toplang'); | |
| if (langToggle && topLang) { | |
| langToggle.addEventListener('click', function() { topLang.classList.toggle('open'); }); | |
| } | |
| var qv = document.getElementById('quickview'); | |
| if (qv) { | |
| document.body.appendChild(qv); | |
| var qvBtn = document.createElement('button'); | |
| qvBtn.className = 'qv-toggle'; | |
| qvBtn.setAttribute('aria-label', 'Toggle page navigation'); | |
| qvBtn.innerHTML = '☰'; | |
| document.body.appendChild(qvBtn); | |
| qvBtn.addEventListener('click', function() { | |
| var isOpen = qv.classList.toggle('open'); | |
| if (isOpen) { | |
| qv.style.top = window.scrollY + 10 + 'px'; | |
| } | |
| }); | |
| window.addEventListener('scroll', function() { qv.classList.remove('open'); }); | |
| } | |
| //--><!]]></script> | |
| </body></html> |