When you are logged out, and you try to access an extension's front controller that is only accessible by being logged in, and are thus sent to the login form if you are using the login_box() function - after you login the redirection that should take you to the extension's front controller (the last page visited) is broken.

If MOD REWRITING is disabled in the ACP, then the attempt to access http://forum/app.php/extension actually redirects you to http://app.php/extension.

If MOD REWRITING is enabled, then the redirect appears to work, but examining the URL looks like MOD REWRITING was disabled, i.e.: instead of being redirected to http://forum/extension, you are redirected to http://forum/app.php/extension

Close examination of the hidden redirect field that is generated by the login_box() shows:
With MOD REWRITING: ./../app.php/extension?
Without MOD REWRITING: ./app.php/extension?

Also note the question marks appended to the redirect url too!