CODEWITHSUNDEEP
file.htaccesswebserver
ThN
ThN

Reputation: 3278

How to restrict access to a file or files using .htaccess?

I want to restrict access to a file or files using .htaccess file. Basically, no one should be able to download file(s) using direct link to the file. However, the file should be accessible from my website.

For instance, say I have a file called Presentation.ppt. I want the visitor to have access to it through my website, but if they try to download it or access it using direct link then the server should reject the request.

Is it possible to do that using .htaccess?

Thank you in advance,

Upvotes: 2

Views: 3787

Answers (4)

ThN
ThN

Reputation: 3278

Thank you all for your answers. I have tried all of your suggestions, but I still couldn't get it working. However, I did come up with a solution that does work.

Step 1: Disable or turn off Option Indexes on your web server by removing the word indexes leaving everything else the same. In some instances, you may be able to do this using .htaccess file. If you are unable to do this with .htaccess, then you will have to look for httpd.conf file in your server. It is usually located at etc/apache/httpd.conf or etc/httpd/conf/httpd.conf. Once you find it, turn this option off in there.

Step 2: Create a folder within your webpage folder and call it whatever you want but make sure it is not easily guessable or that it is obvious (i.e. Joe33CompanyOCT2MeBoss). Then, move the files you want to hide or protect from your visitor into this folder.

Step 3: Within robot.txt file, disallow all bots or crawlers from indexing your folder or the files within this folder by entering, "Disallow yourfoldername."

Step 4: Then you will have to create a PHP file using a similar code below. The code below will force download. 

        $File1 = 'http://yourwebsite.com/Joe33CompanyOCT2MeBoss/Presentation.ppt';
        header("Content-Disposition: attachment; filename=\"".basename($File1)."\"");
        header("Content-Type: application/force-download");
        ob_end_clean();
        flush();
        readfile($File1);
        exit;

This way direct path to the file is hidden from your visitor and even though they can download the file directly they simply don't know the actual URL to the file, because force download php code doesn't reveal the actual path to the file. So, now my visitors to my website has to go through my webpage for downloading this file instead of directly.

Following stackoverflow questions have been very instrumental in helping me solve my programming issues. Thanks,

How to Automatically Start a Download in PHP?

php file force download

Upvotes: 2

Jon Lin
Jon Lin

Reputation: 143876

For instance, say I have a file called Presentation.ppt. I want the visitor to have access to it through my website, but if they try to download it or access it using direct link then the server should reject the request.

Is it possible to do that using .htaccess?

It's possible but there's ways to get around it. You need to check against the referer sent by the browser, but anyone can spoof that and sometimes a browser may choose to not even include a referer.

If you are trying to protect the file Presentation.ppt, put these rules in the htaccess file in your document root:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^(https?://)?your_website.com
RewriteRule ^/?path/to/Presentation.ppt - [L,F]

If you want to protect a folder /path/images/ then:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^(https?://)?your_website.com
RewriteRule ^/?path/images - [L,F]

Upvotes: 2

mr_plum
mr_plum

Reputation: 2437

You can deny access to the directory for every IPA but the server's: 

<Directory /dir/of/presentation>
    Order Allow,Deny
    Allow from 127.0.0.1
    Deny from All
</Directory>

That wonk work, as you pointed out.

How about using Mod Rewrite with a rule that maps /dir/of/presentation/* to a forbidden page. That way a direct link won't work. A request for http://site/content/presentation.ppt
could get redirected to http://site/forbidden.html

Internally, you could make a link to http://authorizedRequest/presentation.ppt map to http://site/content/presentation.ppt

It's just security through obscurity. It wouldn't prevent anyone from typing your "secret" URI into their browser directly.

Upvotes: 1

arkascha
arkascha

Reputation: 42885

The easiest (though not bulletproof) is to redirect the user agent when the HTTP_REFERER is not correct. This can be done using mod_rewrite in the server configuration or (second choice) inside a .htaccess like file. It helps against simply hotlinking (links referencing your file by url).

You should read the fine documentation of moapaches d_rewrite.

Upvotes: 0

Related Questions