Solved

Is there any way to restrict the downloading of files within a subfolder using special .htaccess rules?

Posted on 2012-03-14
4
235 Views
Last Modified: 2012-08-13
We have a bunch of client files sitting in a "uploads" folder on our Apache-based site.  Although the directory itself is NOT browseable (403 forbidden - Directory Listing not allowed) ... the client has become concerned that the files themselves might be compromised somehow, .. or indexed by search engines.

Is there any way that we can apply special .htaccess rules to that uploads folder so that the files contained within it can only be downloaded using a PHP script (or something like that)?  We're just looking for a way to secure those files somehow -- without having to reprogram the site so that the file uploads are stored and served up from outside the site root.  Please advise.

Thanks
- Yvan
0
Comment
Question by:egoselfaxis
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 110

Accepted Solution

by:
Ray Paseur earned 500 total points
ID: 37719925
For the most safety, move the directory outside of the WWW root.  But that said, if your server returns a 403 forbidden to browsers, you are also returning a 403 forbidden to search engines.  No compromise is likely at all since you're not sending the data -- just the "forbidden" headers.
0
 
LVL 15

Expert Comment

by:Ess Kay
ID: 37720064
here is some info for it

http://www.javascriptkit.com/howto/htaccess.shtml

hope it helps
0
 
LVL 7

Expert Comment

by:torakeshb
ID: 37723890
Refer to the article http://www.experts-exchange.com/OS/Linux/A_8789-How-websites-can-be-redirected.html. You may need some customization as per your requirement
0
 
LVL 110

Expert Comment

by:Ray Paseur
ID: 37744101
Was there something wrong with this answer?  Why did you mark it down to a "B"?  What was missing?
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
This article discusses four methods for overlaying images in a container on a web page
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question