A rewrite is a routing rule that sends a request for one URL path to a different backend destination while keeping the browser-visible URL unchanged. The user still sees the original path, but the server or framework handles the request as if it matched another route, file, or handler.
Rewrites matter because they sit on the trust boundary between public traffic and internal application logic. They are useful for migrations, clean URLs, and traffic shaping, but they can also hide where a request really goes. In security incidents, weak rewrite rules can bypass path-based checks, expose internal endpoints, or steer attacker-controlled input toward sensitive services. Defenders should treat rewrite destinations as privileged, validate route patterns carefully, and test that access control still works after routing changes.