Why is my Apache able to 200 serve .php files that include a trailing slash?

Running Apache 2.4.6 with vhosts and PHP 7.2.34 and just discovered a weird problem.

A valid URL on my vhosts, such as http://example.com/exists.php is also able to be served with a trailing slash; e.g. http://example.com/exists.php/.

This is only the case if the file being served ends with .php, not .html, .txt, etc.

There are no mod_rewrite rules affecting the vhosts. My php.ini looks good.

Any ideas? Normal behavior?


It's normal behavior. You can also add other trailing slashes or letters like:

  • http://example.com/exists.php/path/to/
  • http://example.com/exists.php/otherpath

it's also used by so some PHP frameworks for URL routing without mod_rewrite.