您的位置: 首页  >  技术问答  >  修改.htaccess以拒绝访问文件夹，但仅允许从我的站点使用ajax访问特定文件

修改.htaccess以拒绝访问文件夹，但仅允许从我的站点使用ajax访问特定文件

分类: 技术问答 • 2022-03-10 10:27:23
问题描述：

in my site "www.website.com" i have a folder with forbidden access using this .htaccess :

RewriteEngine On
RewriteBase /
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+)/.*\ HTTP [NC]
RewriteRule .* - [F,L]

Now i want to have access only from my site "www.website.com" to a specific PHP files using Ajax (POST). I have modify .htaccess like this:

RewriteEngine On
RewriteBase /
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+)/.*\ HTTP [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://.*website.com [NC]
RewriteRule \.(php)$ - [NC,F,L]

But with this code i have access to all php files. I need to access only in *Add.php and *Edit.php . These files are in several subfolders. What should i do ? Is this the right way to do this?

在我的网站“www.website.com”中我有一个使用此 .htaccess禁止访问的文件夹 code>： p> 

  RewriteEngine On 
RewriteBase / 
RewriteCond％{THE_REQUEST} ^ [AZ] {3,9} \ /（[^ /] +）/。  * \ HTTP [NC] 
RewriteRule。*  -  [F，L] 
  code>  pre> 
 
 
现在我只想访问我的网站“www.website.com” 使用Ajax（POST）到特定的PHP文件。 我修改了 .htaccess  code>，如下所示： p> 
 
 
  RewriteEngine On 
RewriteBase / 
RewriteCond％{THE_REQUEST} ^ [AZ] {3,9} \  /（[^ /] +）/.* \ HTTP [NC] 
RewriteCond％{HTTP_REFERER}！^ $ 
RewriteCond％{HTTP_REFERER}！^ http（s）？：//.* website.com [NC] \  nRewriteRule \。（php）$  -  [NC，F，L] 
  code>  pre> 
 
 
但是使用此代码我可以访问所有php文件。 我只需要在 * Add.php  code>和 * Edit.php  code>中访问。 这些文件位于多个子文件夹中。 我该怎么办 ？ 这是正确的方法吗？ p> 
  div>

答

Well, after a lot of searching, reading and testing i conclude that the best way to secure a website that works using Ajax is:

1 - Have only one (if possible) file like router.php that will "route" depending on the POST/GET navigation variables, using includes to files that are in sub-folders.

2 - Except of SESSION-based authentication you could also implement Basic HTTP authentication and/or HTTPS (SSL) to secure user credentials when login. If you are not using HTTPs, you should use field or form encryption because in 'wire' all are in plaintext. I have found useful this http://www.itsyndicate.ca/jquery/

3 - In every POST use Token-based Authentication with a token that is created from user credentials, send over with the request and then re-calculate and compare.

4 - I have tried lot of combinations for using only one .htaccess in document ROOT but always something was missing, or miss-configured or not working as i expected. So, i found more simple to use one .htaccess in every sub-folder instead of one in the root. In sub-folders depending on what they contain's .htaccess should look like this:

### No Direct Access to All files ###
<IfModule mod_authz_host.c>
    Order Deny,Allow
    Deny from all
#   Allow from 127.0.0.1
</IfModule>

### One of the alternative ways with mod_rewrite ###
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+)/.*\ HTTP [NC]
    RewriteRule .* - [F,L]
</IfModule>

### permit ONLY filetypes in a pattern ###
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteCond %{REQUEST_FILENAME} ^(.+)\.(css|js|gif|png|jpe?g|woff)$
    RewriteRule .? - [S=1]
    RewriteRule ^(.+)$ - [F,L,NC]
</IfModule>

I prefer THE_REQUEST because this does not include any additional headers sent by the browser. This value has not been unescaped (decoded), unlike most other variables, and it has no point to spoof. I use skip [S=1] because i prefer to tell "If that then this rule not valid", so, in any other case the rule that "Denies" it is valid.

5 - For extra security you can use code inside php files, implementing one of the methods described in this article: Prevent direct access to a php include file

6 - Also, if you are Forbidding Image Hotlinking (and NOT only) described here , beware that referer can be spoofed!!

相关推荐