Different handling of requests with trailing slash by .htaccess for API endpoints

[vHeemstra]

• Laravel Version: 7.12.0
• PHP Version: 7.4.6
• Database Driver & Version: MariaDB 10.4.11

Description:

When making a PUT, PATCH or DELETE request to a standard API resource route (api/somemodel/{id}), but with a trailing slash, the .htaccess file redirects this to the non-trailing-slash url. This is great for regular pages I imagine (as discussed way back at #23), but it loses the post data and makes it a GET request.

This might be confusing for any user of the API (they get back the right resource, but unchanged and no error/warning). To warn this 'misuse' of the trailing slash for endpoints, I created a Middleware that would spot the trailing slash and throw a descriptive error. But the trailing slash is already gone because .htaccess made the redirect.

Suggestion:

Edit the .htaccess to exclude all /api/ (or other global API endpoint starter from .env?) urls from the 'trailing-slash to non-trailing-slash' redirect.

Or is there a better way to handle this?

[vHeemstra]

Example

Here is an example for the change in the .htaccess file in the public folder.

Change:

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

to:

    # Redirect Trailing Slashes If Not A Folder... AND not an API endpoint call
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} ^(?!\/api\/)(.+)\/$
    RewriteRule ^ %1 [L,R=301]

This will exclude the /api/ endpoint base url from the redirect.

For testing, see this page or this page

FYI: The trailing slash will be filtered out by the routing system (not sure which class), so a trailing slash request will be handled as one without it. (If you use standard apiResource() routing definition.)
The advantage here is that you can check for this trailing slash in a custom Middleware and abort(400, 'Bad request. Do not use trailing slash for API calls.') if you would want to. (Or just let it go through.)

[linomassarani]

You are the fucking one! Thanks you brother!

[mnr73]

thank you :)

[vHeemstra]

How-To

Here a small how-to including the code for the above mentioned middleware.

1) Edit .htaccess

Open the project's public/.htaccess file, and change

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

to

    # Redirect Trailing Slashes If Not A Folder... AND Not An API Endpoint Call
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} ^(?!\/api\/)(.+)\/$
    RewriteRule ^ %1 [L,R=301]

Note: \/api\/ is the chosen API endpoint URI prefix, as set in app/Providers/RouteServiceProvider.php inside the mapApiRoutes() method.

2) Create the middleware class (see docs)

Run the Artisan command:

php artisan make:middleware WarnIfTrailingSlashInApi

or create a new file called WarnIfTrailingSlashInApi.php inside the app/Http/Middleware folder.

Change the contents of this file to:

<?php

namespace App\Http\Middleware;

use Closure;

class WarnIfTrailingSlashInApi
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if (preg_match('/^\/api\/(.+\/)?$/i', $_SERVER['REQUEST_URI'])) {
            abort(400, 'Trailing slash is not allowed for API calls');
        }
        return $next($request);
    }
}

Again, note the chosen \/api\/ endpoint URI prefix.

3) Add middleware to the stack (see docs)

Inside app/Http/Kernel.php, add the middleware to the $middleware array at the end:

class Kernel extends HttpKernel
{
    /**
     * The application's global HTTP middleware stack.
     *
     * These middleware are run during every request to your application.
     *
     * @var array
     */
    protected $middleware = [
        ...
        \App\Http\Middleware\WarnIfTrailingSlashInApi::class, // used here to go before routing
    ];