Best unofficial Apache Server developers community

Answers

Can we restrict the files in a directory accessible only by the specific file/files in specific folder

⇧

⇩

51 views

ex.

there are css folder storing css files and page folder storing html,php.

anyone trying to access css folder from http request will be denied.

but any pages in page folder will able to use css files in folder css

In other word,only files in page folder can use files in css folder

can we do this?

apache .htaccess

asked May 22, 2011 1:59 am CDT

thReality

posted via ServerFault

2 Answers

Newest Most Voted

⇧

⇩

rewritecond %{HTTP_REFERER} !^http://www.yoursite.com/page
rewriterule ^/css - [F]

normally all the requests to css files are coming with a referer set to the page that uses the css. so you can forbid access to css files if the request comes with a referer different than http://yoursite.com/page/

full example:

apache vhost config:

<virtualhost *:80>
servername t1
serversignature off
documentroot /var/www/t1
rewriteengine on
rewriteloglevel 9
rewritelog /var/log/apache2/rewrite.log
rewritecond %{HTTP_REFERER} !^http://t1/page
rewriterule ^/css - [F]

the docroot setup:

root@pinkpony:/var/www/t1/css# ls -al /var/www/t1/{page,css}
/var/www/t1/css:
total 12
drwxr-xr-x 2 root root 4096 2011-05-22 14:07 .
drwxr-xr-x 5 root root 4096 2011-05-22 14:05 ..
-rw-r--r-- 1 root root   11 2011-05-22 14:07 x.css

/var/www/t1/page:
total 12
drwxr-xr-x 2 root root 4096 2011-05-22 14:07 .
drwxr-xr-x 5 root root 4096 2011-05-22 14:05 ..
-rw-r--r-- 1 root root  117 2011-05-22 14:07 x.html
root@pinkpony:/var/www/t1/css#

issuing a direct request to /css/x.css, rewrite.log snip:

192.168.1.4 - - [22/May/2011:14:11:57 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a17ec60/initial] (2) init rewrite engine with requested uri /css/x.css
192.168.1.4 - - [22/May/2011:14:11:57 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a17ec60/initial] (3) applying pattern '^/css' to uri '/css/x.css'
192.168.1.4 - - [22/May/2011:14:11:57 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a17ec60/initial] (4) RewriteCond: input='' pattern='!^http://t1/page' => matched
192.168.1.4 - - [22/May/2011:14:11:57 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a17ec60/initial] (2) forcing responsecode 403 for /css/x.css

issuing a request to /page/x.html, page content is:

root@pinkpony:/var/www/t1/css# cat ../page/x.html 
<html>
<head>
<link rel="stylesheet" type="text/css" href="http://t1/css/x.css">
</head>
<body>
blah
</body>
</html>

request to http://t1/page/x.html:

192.168.1.4 - - [22/May/2011:14:13:19 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a184c90/initial] (2) init rewrite engine with requested uri /page/x.html
192.168.1.4 - - [22/May/2011:14:13:19 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a184c90/initial] (3) applying pattern '^/css' to uri '/page/x.html'
192.168.1.4 - - [22/May/2011:14:13:19 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a184c90/initial] (1) pass through /page/x.html
192.168.1.4 - - [22/May/2011:14:13:19 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a182c80/initial] (2) init rewrite engine with requested uri /css/x.css
192.168.1.4 - - [22/May/2011:14:13:19 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a182c80/initial] (3) applying pattern '^/css' to uri '/css/x.css'
192.168.1.4 - - [22/May/2011:14:13:19 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a182c80/initial] (4) RewriteCond: input='http://t1/page/x.html' pattern='!^http://t1/page' => not-matched
192.168.1.4 - - [22/May/2011:14:13:19 +0300] [t1/sid#7f4c69ceb210][rid#7f4c6a182c80/initial] (1) pass through /css/x.css

so it works as expected. however, no one stops anyone to issue a fake referer with the request. the technique I described is used to kill leeches.

answered May 22, 2011 6:16 pm CDT

adirau

⇧

⇩

I do not think this is possible the way you describe it, because on the server side you cannot distinguish if a resource has been requested individually or as part of a page. There are simply separate HTTP requests the user's browser makes, first requesting the page itself, then the required resources such as images, stylesheets and the likes.

What would be possible instead is inlining the stylesheets on the server side using Server Side Includes or any other dynamic server-side technology. You mentioned using PHP, so you could simply put your pages together on the server side and send them as a single response while keeping the CSS folder restricted for direct access.

This will not keep people from accessing your stylesheets, though. They are simply part of the page then instead of separate files.

answered May 22, 2011 6:16 pm CDT

Axel Knauf

Your answer

Similar discussion threads

Re: Replicate files to specific storage nodes?
July 29, 2010 03:21:45 PM
On Jul 29, 2010, at 3:42, Warpzv wrote: > 3. If not, there is any suggest for my case? The typical solution is to put a cache (squid, varnish or a CDN) in front of the cluster and let that take care of it. We use a CDN -- at least in North…

Geronimo-specific openejb schema files?
April 14, 2011 02:20:35 AM
Hi devs, Could anyone share with me what the differences are between following 2 files, and it seems [1] is not working any more since we can barely see it in document or sample application. Can we safely remove [1]? [1].…

Targeting specific files in reverse proxy mode
March 3, 2011 12:26:44 PM
I have setup apache2 to run in reverse proxy mode with mod_proxy and ProxyPass. I am trying to target the robots.txt file to modify it with mod_ext_filter and am having no such luck. I have mod_ext_filter working fine changing links on other parts…

Created: (SLING-2022) JarExecutor: optionally run in a specific folder
March 7, 2011 07:51:21 AM
JarExecutor: optionally run in a specific folder

Closed: (SLING-1827) Mechanism to process specific jobs on specific machines
January 24, 2011 06:00:34 AM
[ https://issues.apache.org/jira/browse/SLING-1827?page=com.atlassian.ji ra.plugin.system.issuetabpanels:all-tabpanel ] Carsten Ziegeler closed SLING-1827.

Created: (SLING-1827) Mechanism to process specific jobs on specific machines
October 8, 2010 08:45:56 AM
Mechanism to process specific jobs on specific machines

Trying to use one index file for all files in a directory
June 10, 2010 11:46:30 AM
Hey, it's my first time using this mailing list, so I apologize if I'm doing something wrong... That said, I have searched for a way to use the index.php file that I have created to be the default for all folders nested in a top level "Documents"…

how do i copy files from a folder to a folder inside the current deployment
October 30, 2010 07:49:13 AM
Hi all, my deployment is successful. Currently I do this in my laptop everytime when I want to deploy my staging environment cap staging deploy:setup cap staging deploy I want to move files from some place in my server to a folder inside the…

Created] (HDFS-1914) Federation: namenode storage directory must be configurable specific to a namen
May 10, 2011 05:48:28 PM
Federation: namenode storage directory must be configurable specific to a namenode

Loading resource or property files embedded in jar file that distributes shared build files?
April 8, 2011 09:10:32 AM
I've created a reusable set of build files using the technique I outlined at http://stackoverflow.com/questions/5124726/what-are-some-good-ways-to- distribute-a-common-ant-file-to-be-included-in-builds/5168745#5168745. This technique relies heavily…

Logging specific info to a separate file
August 13, 2010 10:53:55 PM
I have a vanilla tomcat, I want to log specific financial-related requests to a separate log file. I've added the following logging.properties to webapps/ROOT/WEB-INF/classes: handlers = org.apache.juli.FileHandler,…

java.lang.NullPointerException only for a specific file
March 28, 2011 07:13:47 AM
Hi, I've a 74MB xml document and I've split it into 2 docs:52MB and 22MB respectively. I'm parsing the file using common Digester library, and everything works perfectly for the small file, but I get a NullPointerExceptio with the big one. I…

Managing cronjobs as a file in solaris with appendifnosuchline for specific servers
January 3, 2011 03:54:37 PM
I want to manage cronjobs as a " file " in solaris through puppet and not using the puppet cron resource. I will be managing the file /var/spool/cron/crontabs/root. I want the cron file to be same across all servers except some servers will have…

Updated: (HIVE-90) TestGetDBs assumes a specific File.list() order
July 23, 2010 05:28:51 AM
[ https://issues.apache.org/jira/browse/HIVE-90?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Carl Steinbach updated HIVE-90:

Can I use both route specific errorHandler and route specific onException
March 5, 2011 02:03:03 AM
Hi, Can I use both route specific errorHandler and route specific onException in the same route? Below is sample route. public void configure() { from("file:D:/temp/onExceptionTest") .errorHandler(defaultErrorHandler() …

Mirror folder with large files
January 24, 2011 11:15:04 AM
Dear list, I'm attempting to mirror a folder containing a few large files from an NFS location to the local drive. Subsequent runs take a lot longer than I'd have expected, after the first run. Using the following block a puppet apply run is…

Re: Managing public folder ACL files
April 6, 2011 08:06:35 AM
Hi Keith, i have the same Problem as you, but in a much smaller variant. Our user_db is in MySQL, so i define acl_groups in user_db and make many group-settings for all situations per public folder. But that could be hard for 1000 folders, so…

Read files from a Shared Directory...
June 22, 2010 11:46:27 AM
Shooting in the dark. I need to read ~140K documents from a Windows-based shared directory structure and "post" them to a processing system. We have two basic interfaces into our system (REST/HTTP and JMS). I'm curious if this is something I…

License for \contrib directory files
December 16, 2010 02:00:57 PM
Hi All, The following eight directories are included under the \contrib directory: bookkeeper fatjar rest zkfuse zkperl zkpython zktreeutil ZooInspector Other than ZooInspector which contains both the Apache V2 and EPL license files, none of…

tools for reading the files in the log directory
April 14, 2011 03:00:21 PM
Are there any existing tools for reading log.ctrl and the actual log files? A quick glance at the engine and testing javadoc doesn't suggest that such tools have been checked into the codeline. But maybe someone has written some tools for their…

Questions and Answers are licensed under cc-wiki license.

Can we restrict the files in a directory accessible only by the specific file/files in specific folder

2 Answers

Your answer

Join with account you already have