Databases
StackOverflow2013
Postsdbo
POUsing PHP/Apache to restrict access to static files (html, css, img, etc)
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POUsing PHP/Apache to restrict access to static files (html, css, img, etc)
    primarykey
    data
    text
    <p>Lets say you have lots of html, css, js, img and etc files within a directory on your server. Normally, any user in internet-land could access those files by simply typing in the full URL like so: <a href="http://example.com/static-files/sub/index.html" rel="noreferrer">http://example.com/static-files/sub/index.html</a></p> <p>Now, what if you only want authorized users to be able to load those files? For this example, lets say your users log in first from a URL like this: <a href="http://example.com/login.php" rel="noreferrer">http://example.com/login.php</a></p> <p>How would you allow the logged in user to view the index.html file (or any of the files under "static-files"), but restrict the file to everyone else?</p> <p>I have come up with two possible solutions thus far:</p> <p><b>Solution 1</b><br> Create the following .htaccess file under "static-files":</p> <pre><code>Options +FollowSymLinks RewriteEngine on RewriteRule ^(.*)$ ../authorize.php?file=$1 [NC] </code></pre> <p>And then in authorize.php...</p> <pre><code>if (isLoggedInUser()) readfile('static-files/'.$_REQUEST['file']); else echo 'denied'; </code></pre> <p>This authorize.php file is grossly over simplified, but you get the idea.</p> <p><b>Solution 2</b><br> Create the following .htaccess file under "static-files":</p> <pre><code>Order Deny,Allow Deny from all Allow from 000.000.000.000 </code></pre> <p>And then my login page could append that .htaccess file with an IP for each user that logs in. Obviously this would also need to have some kind of cleanup routine to purge out old or no longer used IPs.</p> <p><hr /> I worry that my first solution could get pretty expensive on the server as the number of users and files they are accessing increases. I think my second solution would be much less expensive, but is also less secure due to IP spoofing and etc. I also worry that writing these IP addresses to the htaccess file could become a bottleneck of the application if there are many simultaneous users. </p> <p>Which of these solutions sounds better, and why? Alternatively, can you think of a completely different solution that would be better than either of these?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USBart
    plurals
    1. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POUsing PHP/Apache to restrict access to static files (html, css, img, etc)
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POUsing PHP/Apache to restrict access to static files (html, css, img, etc)
      1. USBart
      1. VTBountyStart
    3. VO
      singulars
      1. POUsing PHP/Apache to restrict access to static files (html, css, img, etc)
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload