我尝试仅允许请求标头/multi以Content-Type开头的传入请求multipart/form-data，而对其他POST、PUT或DELETE端点的请求必须始终具有application/json Content-Type.
在我的网络根文件中执行以下操作时.htaccess（无根访问权限）：
# Enforce multipart/form-data content type for /multi routes
RewriteCond %{REQUEST_URI} ^/multi [NC]
RewriteCond %{HTTP:Content-Type} !^multipart/form-data; [NC]
RewriteRule ^ - [R=400,L,END]
# Enforce JSON content type for all other POST, PUT, and DELETE endpoints
RewriteCond %{REQUEST_METHOD} ^(POST|PUT|DELETE)$
RewriteCond %{HTTP:Content-Type} !^application/json [NC]
RewriteCond %{REQUEST_URI} !^/multi [NC]
RewriteRule ^ - [R=400,L,END]
...然后发送POST /multiwith Content-Type: multipart/form-data，我得到 Apache 的400 Bad Request响应。当我删除第二个重写块时，请求就会通过。为什么在发送POST /multiwith时应用第二个重写块Content-Type: multipart/form-data，尽管我有条件RewriteCond %{REQUEST_URI} !^/multi [NC]，这应该阻止它被应用？
当我在启用第二个重写块的情况下发送请求时检查 apache 错误日志时，我根本没有错误日志。当我检查 Apache Dom 日志时，我只是收到了一个传入请求以/multi产生400响应。因此，似乎确实应用了第二个重写规则，这对我来说没有意义。
完整的 .htaccess 文件
# Prevent files whose name starts with ".ht" from frontend access
<FilesMatch "^\.ht">
Require all denied
</FilesMatch>
# Set global Rules for document root directory
Options Indexes FollowSymLinks
Require all granted
# Specify rewrite rules
RewriteEngine On
# Authorization Header seems to be stripped by default, hence explicitly enable it
# Doing it via the rewrite rule is not the native way of doing it, and would need an improved rule to avoid that an
# Authorization HTTP header with an empty value is still passed to PHP
# RewriteCond %{HTTP:Authorization} ^(.*)
# RewriteRule .* - [e=HTTP_AUTHORIZATION:%1]
CGIPassAuth On
# Enforce multipart/form-data content type for /multi route
RewriteCond %{REQUEST_URI} ^/multi [NC]
RewriteCond %{HTTP:Content-Type} !^multipart/form-data; [NC]
RewriteRule ^ - [R=400,L,END]
# Enforce JSON content type for all other POST, PUT, and DELETE endpoints (return a 400 Bad Request otherwise)
RewriteCond %{REQUEST_METHOD} ^(POST|PUT|DELETE)$
RewriteCond %{HTTP:Content-Type} !^application/json [NC]
RewriteCond %{REQUEST_URI} !^/multi [NC]
RewriteRule ^ - [R=400,L,END]
# Route all incoming requests through index.php, except if it's for existing files
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule . /index.php [L]
# Ensure that png images, javascript and css files are all delivered with correct mime type. mod_mime must be enabled.
AddType application/javascript .js
AddType image/png .png
AddType text/css .css
# Add an 'Expires' HTTP header for all accessed js, css and png image files. mod_expires must be enabled.
ExpiresActive On
ExpiresByType image/png "access plus 1 year"
ExpiresByType application/javascript "access plus 1 year"
ExpiresByType text/css "access plus 1 year"
# Also add a Cache-Control HTTP header for the same cache lifetime of 1 year, to cover all browsers. mod_headers needed.
<FilesMatch "\.(js|css|png)$">
Header set Cache-Control "public, max-age=31536000"
</FilesMatch>
# Define Image Uploads directory, to be able to access img uploads while uploads are kept outside from document root
RewriteRule ^images/(.*)$ /uploads/imgs/$1 [L]
# Ensure that all icons are delivered with the image/jpeg MIME type
RewriteRule ^icons/ - [E=CONTENT_TYPE:image/png]
