77

I'm loading my files (pdf, doc, flv, etc) into a buffer and serving them to my users with a script. I need my script to be able to access the file but not allow direct access to it. Whats the best way to achieve this? Should I be doing something with my permissions or locking out the directory with .htaccess?

1

7 Answers 7

98

The safest way is to put the files you want kept to yourself outside of the web root directory, like Damien suggested. This works because the web server follows local file system privileges, not its own privileges.

However, there are a lot of hosting companies that only give you access to the web root. To still prevent HTTP requests to the files, put them into a directory by themselves with a .htaccess file that blocks all communication. For example,

Order deny,allow
Deny from all

Your web server, and therefore your server side language, will still be able to read them because the directory's local permissions allow the web server to read and execute the files.

9
  • i have used this inside audio folder but it is stoping my audio player to play audio. I am using sound manager 2 to play audio. Is there any work around to allow only sound manager to play that audio file but stop anyother direct access?
    – sonill
    Jul 29, 2013 at 6:07
  • 5
    @sonill - You can white list certain IPs to be able to access these directories. For example, adding a new line with Allow from 127.0.0.1 will allow your server, including any server side code, to access files in that directory. More documentation on these bits is available at httpd.apache.org/docs/2.4/mod/mod_access_compat.html#allow
    – Sam Bisbee
    Jul 30, 2013 at 16:38
  • 1
    "However, there are a lot of hosting companies that only give you access to the web root." Why can't those companies put the web root one level lower than the FTP root? Do they have zero knowledge of how PHP works (or rather is it an oversight which is more likely) or do they only care about their own security and money? Oh well, just pick a company that actually gives a damn about your website's security. Mar 30, 2017 at 4:58
  • 1
    I tried this, but am not able to open the files after they download: failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden
    – zylo
    Sep 14, 2017 at 16:34
  • 2
    Not work when we try to access from php script. you have any code how to access that file Jan 2, 2018 at 6:01
36

That is how I prevented direct access from URL to my ini files. Paste the following code in .htaccess file on root. (no need to create extra folder)

<Files ~ "\.ini$">
  Order allow,deny
  Deny from all
</Files>

my settings.ini file is on the root, and without this code is accessible www.mydomain.com/settings.ini

3

in httpd.conf to block browser & wget access to include files especially say db.inc or config.inc . Note you cannot chain file types in the directive instead create multiple file directives.

<Files ~ "\.inc$">
Order allow,deny
Deny from all
</Files>

to test your config before restarting apache

service httpd configtest

then (graceful restart)

service httpd graceful
2

Are the files on the same server as the PHP script? If so, just keep the files out of the web root and make sure your PHP script has read permissions for wherever they're stored.

1

If you have access to you httpd.conf file (in ubuntu it is in the /etc/apache2 directory), you should add the same lines that you would to the .htaccess file in the specific directory. That is (for example):

ServerName YOURSERVERNAMEHERE
<Directory /var/www/>
AllowOverride None
order deny,allow
Options -Indexes FollowSymLinks
</Directory>

Do this for every directory that you want to control the information, and you will have one file in one spot to manage all access. It the example above, I did it for the root directory, /var/www.

This option may not be available with outsourced hosting, especially shared hosting. But it is a better option than adding many .htaccess files.

1

To prevent .ini files from web access put the following into apache2.conf

<Files ~ "\.ini$">
Order allow,deny
Deny from all
</Files>
0

How about custom module based .htaccess script (like its used in CodeIgniter)? I tried and it worked good in CodeIgniter apps. Any ideas to use it on other apps?

<IfModule authz_core_module>
    Require all denied
</IfModule>
<IfModule !authz_core_module>
    Deny from all
</IfModule>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.