Member Avatar for sash_kp

While i try to access the .htaccess file its saying access forbidden,which is obvious. But the listing of all other files also getting displayed,i.e no restrictions are imposed on those files which are under the same directory as the .htaccess. However i want to restrict everyone but myself from those files too. Here is my httpd.config

inside directory of httpd.config

Options Indexes FollowSymLinks Includes ExecCGI

AllowOverride ALL

Require all granted

<Files ".ht*">
Require all denied
</Files>

my .htaccess file
# deny everyone but myself
<Limit GET POST PUT>
    Options -Indexes
    Order allow,deny
    Deny from all
</Limit>
  • 2 Contributors
  • 3 Replies
  • 298 Views
  • 12 Hours Discussion Span
  • Latest Post Latest Post by cereal

Dani AI

Generated

Two things are causing the behaviour you see: directives placed inside a <Limit> block don’t behave the way you expect for directory-level settings, and there’s a mix of old (Allow/Deny) and new (Require) access syntaxes. As already showed, directory listing is coming from the Indexes option inherited for that directory; moving “turn off indexing” out of a <Limit> container and using version-appropriate access controls fixes that. As pointed out, IP-based rules only help if you have a static IP and referer checks are easily spoofed.

If you want a quick, reliable fix: add HTTP basic authentication to the directory so anyone who isn’t you needs a username/password. Example .htaccess (Apache 2.4):

AuthType Basic
AuthName "Restricted area"
AuthUserFile /full/path/to/.htpasswd
Require valid-user

Create the .htpasswd with the htpasswd tool and place it outside the webroot. This is simple and works regardless of whether PHP runs as a module or FPM.

For the most secure and flexible option, keep the files outside the document root and serve them with a small PHP gateway that checks your login/session before streaming the file. Example serve script (sketch):

<?php
session_start();
if (empty($_SESSION['user_logged_in'])) { header('HTTP/1.1 403 Forbidden'); exit; }
$base = __DIR__ . '/../protected';
$file = basename($_GET['file'] ?? '');
$path = realpath($base . DIRECTORY_SEPARATOR . $file);
if (!$path || strpos($path, realpath($base)) !== 0) { header('HTTP/1.1 404 Not Found'); exit; }
$mime = finfo_file(finfo_open(FILEINFO_MIME_TYPE), $path);
header('Content-Type: '.$mime);
header('Content-Length: '.filesize($path));
readfile($path);
exit;

Troubleshooting checklist: confirm Apache actually reads your .htaccess (AllowOverride must permit the directives you use), check the Apache version (2.2 vs 2.4) and use the matching access syntax, verify whether PHP runs as an Apache module or via FPM (apache_setenv only works with mod_php), and inspect the error/access logs after a change. For long-term safety prefer authentication or a protected gateway rather than IP or referer tricks.

Recommended Answers

All 3 Replies

Member Avatar for cereal

If you have a static IP you can add it as allow rule:

<Limit GET POST PUT>
    Options -Indexes
    Order allow,deny
    Deny from all
    Allow from xxx.xxx.xxx.xxx
</Limit>

Otherwise you can use the Authenticantion modules: http://httpd.apache.org/docs/2.0/howto/auth.html

Edited by cereal
commented: Static id,that's the problem in my case. I don't have one. Is there any other way to achieve the same functionality? Like,could we use php in order to get the current ip and auto set it in our .htaccess? +0
Member Avatar for sash_kp

Static ip,that's the problem in my case. I don't have one. Is there any other way to achieve the same functionality? Like,could we use php in order to get the current ip and auto set it in our .htaccess?

Edited by sash_kp
Member Avatar for cereal

Inside the .htaccess file write:

order allow,deny
deny from all
allow from env=ALLOW_ME

And then inside a PHP file:

<?php
apache_setenv('ALLOW_ME', true);

It should work if PHP is managed as module by Apache (I cannot test it right now). It can work also by checking the referer:

SetEnvIF Referer "" allowme
order allow,deny
deny from all
allow from env=allowme

But this last example is not safe because the referer can be spoofed easily.

Reference for more options:

Otherwise with PHP: use function to list the files of the restricted path and sessions to limit the access to the listings.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.