The rule means that requests to /test/status/ will be redirected to /rewrite-status the url will be rewritten. /test/status/ %{context-path}/rewrite-status ^/StartAuthentication$ /dispatcher?mod=id_saml1&action=GetArtifact ^/StartAuthentication\?(.*)$ /dispatcher?mod=id_saml1&action=GetArtifact&$1 ^/auth/([a-zA-Z0-9]+)/([a-zA-Z0-9]+)$ /dispatcher?mod=$1&action=$2 ^/auth/([a-zA-Z0-9]+)/([a-zA-Z0-9]+)\?(.*)$ /dispatcher?mod=$1&action=$2&$3 ^/pvp2/metadata$ /dispatcher?mod=id_pvp2x&action=Metadata&%{query-string} ^/pvp2/redirect$ /dispatcher?mod=id_pvp2x&action=Redirect&endpointtype=idp&%{query-string} ^/pvp2/post$ /dispatcher?mod=id_pvp2x&action=Post&endpointtype=idp&%{query-string} ^/pvp2/Soap$ /dispatcher?mod=id_pvp2x&action=Soap&endpointtype=idp ^/pvp2/attributequery$ /dispatcher?mod=id_pvp2x&action=AttributeQuery&endpointtype=idp ^/pvp2/sp/redirect$ /dispatcher?mod=id_pvp2x&action=Redirect&endpointtype=sp&%{query-string} ^/pvp2/sp/post$ /dispatcher?mod=id_pvp2x&action=Post&endpointtype=sp&%{query-string} ^/stork2/StartAuthentication$ /dispatcher?mod=id_stork2&action=AuthenticationRequest&%{query-string} ^/stork2/ResumeAuthentication$ /dispatcher?mod=id_stork2&action=AttributeCollector&%{query-string} ^/stork2/CompleteAuthentication$ /dispatcher?mod=id_stork2&action=ConsentEvaluator&%{query-string} ^/stork2/SendPEPSAuthnRequest$ /dispatcher?mod=id_stork2&action=AuthenticationRequest&%{query-string} ^/stork2/ServiceProvider$ /dispatcher?mod=id_stork2&action=AuthenticationRequest&%{query-string} ^/stork2/SendPEPSAuthnRequest$ /dispatcher?mod=id_stork2&action=AuthenticationRequest&%{query-string} ^/stork2/RetrieveMandate$ /dispatcher?mod=id_stork2&action=MandateRetrievalRequest&%{query-string} ^/oauth2/auth\\?(.*)$ /dispatcher?mod=id_oauth20&action=AUTH&%{query-string} ^/oauth2/token\\?(.*)$ /dispatcher?mod=id_oauth20&action=TOKEN&%{query-string} The outbound-rule specifies that when response.encodeURL is called (if you are using JSTL c:url) the url /rewrite-status will be rewritten to /test/status/. The above rule and this outbound-rule means that end users should never see the url /rewrite-status only /test/status/ both in thier location bar and in hyperlinks in your pages. /rewrite-status /test/status/