CODEWITHSUNDEEP
apache.htaccessmod-rewrite
Edward
Edward

Reputation: 4631

Hiding files even from authenticated users using .htaccess

I'd like to use settings in my .htaccess-file to exclude certain files from being displayed.

The .htaccess-file in my root directory contains:

SetEnvIf Request_URI ^/showerror.php noauth=1
#SetEnvIf Request_URI ^/data/important.json noway=1

Order Deny,Allow
Satisfy any
Deny from all
Require user TestUser
Allow from env=noauth
#Deny from env=noway

The .htaccess-File of the folder /data/ contains:

<Files "important.json">
#Order Allow,Deny
Deny from all
</Files>

It seems that the Satisfy any allows authenticated users to view the file. So is there a way to also exclude authenticated users from viewing the content of important.json?

Upvotes: 2

Views: 55

Answers (1)

R_User
R_User

Reputation: 11082

You can simply overwrite the require of your root-.htaccess with the following require-setting in the .htaccess of your subdirectory:

Require all denied

Also see: https://httpd.apache.org/docs/current/upgrading.html

If you'd like to do this file by file, use:

<Files "important.json">
  Require all denied
</Files>

Upvotes: 2

Related Questions