Image styles require mod_rewrite

I was caught out by this.

I just setup a new development system (Ubuntu 16.04 LTS). Everything worked wonderfully except image styles. I finally found this issue realized that I had forgotten to enable mod_rewrite.

I haven't looked to see if it is fixable or not. If not, then I think there should be a documented warning somewhere.

I took a look at this.

Image styles do not work without mod_rewrite because of the security related SetHandler lines in sites/default/files/.htaccess

i.e.,

# Set the catch-all handler to prevent scripts from being executed.
SetHandler Drupal_Security_Do_Not_Remove_See_SA_2006_006
<Files *>
  # Override the handler again if we're run later in the evaluation list.
  SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003
</Files>

With those in place, the FallbackResource directive in the root .htaccess does not work. A request to a non-existent /sites/default/files/someimage.png does not fall back to index.php. It returns a 404.

Images styles work without mod_rewrite if the SetHandler lines are removed or commented out.

I don't know if there is a secure solution to this. We probably need comments from some security experts.

Even though it's been long closed, I'll add https://www.drupal.org/node/2382513 as a related issue. The final result of that issue perhaps isn't as complete as was thought at the time.

Yet another sting related to the behaviour change around Clean URLs for D8.

Documentation here: https://www.drupal.org/getting-started/clean-urls#enabling-8

Enabling Clean URLs in Drupal

The standard Drupal installation contains a sample .htaccess file that supports Clean URLs, so make sure this file exists before enabling Clean URLs. Before copying this file make sure there is a dot , in the .htaccess file's name. It is very important to how Apache works.

Drupal 8.x

In Drupal 8, clean URLS are enabled by default and can't be disabled. You will need some form of rewrite module installed on your web server.

Drupal 7.x

In Drupal 7, the installer tests for compatibility with Clean URLs as a part of the installation process. If the environment is tested as compatible with Clean URLs, it will be enabled as part of the installation process and no further action is required to enable Clean URLs.

I had experiencing same problem with images styles. Image crops were not generated and there was no error.

After little debugging I have found out that if I remove "SetHandler Drupal_Security_Do_Not_Remove_See_SA_2013_003" from "files" .htaccess everything work. Than I have found this thread and enabled apache's mod_rewrite and images style are now generated correctly.

Thank you!

Chiming in to say that we were having issues with image generation etc due to the .htaccess file in sites/default/files - and had removed it as a temporary workaround on 2 different Drupal8 sites.

I was unhappy at the idea of degrading our security and so have been researching a proper fix - simply enabling mod_rewrite has fixed the issue and allowed us to put the .htaccess back into proper usage.

Thanks to @chi on Slack for pointing me to this page. Very glad to have this issue solved.

(So, yes, it probably /does/ require mod_rewrite still ;))

I encountered the same issue with Drupal 8.6.1 and using Apache without mod_rewrite enabled.
Everything seemed to work properly but the image styles.

This was a problem recently for simplytest.me. Adding mod_rewrite fixed the issue:

#3162126: Image styles either aren't generated or can't be downloaded

This is a big deal and it's not obvious what's wrong because there are no errors in the Drupal logs.

The webserver requirements now say the following

You can use the Apache 'mod_rewrite' extension to allow for clean URLs. Note that with Drupal 8, clean urls are enabled by default and can't be disabled, so mod_rewrite needs to be installed and enabled for Drupal 8 to work.

So we can mark this as fixed