.htaccess deny access to subdirectories from a certain domain

grimnebluna

9/13/23, 7:50 AM

I have a server with a security flaw:

There's the main site https://example.com (on server /var/www folder) Then there's an additional app (on server /var/www/app/public) that is configured to be on https://app.example.com.

So the app is also reachable via https://example.com/app/public (i'd like to change that)

I have also the problem that the whole app is saved on the server for the developer. Means also all resource files are stored on a public folder, for example https://example.com/app/config/settings.php

Now to fix this I thought I'd put a .htaccess into https://example.com/app with the following code:

RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^example\.com/app$ [NC]
RewriteRule ^(.*)$ https://app.example.com/ [R=301,L]

This would redirect everything with the wrong URL (example.com/app/, example.com/app/public, example.com/app/resources, ...) to https://app.example.com.

But when testing it, it doesn't work. I've probably messed up the syntax. Not very experienced with .htaccess. Tried for an hour with a .htaccess tester but didn't succeed. Can you (1) tell me what I'm doing wrong with the .htaccess syntax and (2) tell me if this workaround with the .htaccess is more or less safe enough?

0 + 0

.htaccess

apache2

Rob

9/13/23, 10:27 AM

Don't use htaccess files and simply place the configuration directives in the htttpd.conf of the specific virtualhost entry for app.example.com and/or www.example.com - https://httpd.apache.org/docs/2.4/howto/htaccess.html#when

grimnebluna

9/13/23, 11:38 AM

thanks for your reply. i've modified the httpd (and httpd-ssl).conf and added `<Directory /var/www/app/> Order Allow,Deny Deny From All </Directory>` inside the <VirtualHost> of the domain example.com. It works!

MrWhite

9/13/23, 11:56 AM

`Order` and `Deny` directives are Apache 2.2 and formerly deprectaed. You should be using `Require all denied` on Apache 2.4+ instead.

grimnebluna

9/13/23, 11:59 AM

ok, will do. thank you!

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: .htaccess deny access to subdirectories from a certain domain

TH: .htaccess ปฏิเสธการเข้าถึงไดเรกทอรีย่อยจากบางโดเมน

RO: .htaccess interzice accesul la subdirectoare dintr-un anumit domeniu

RU: .htaccess запретить доступ к подкаталогам из определенного домена

VI: .htaccess từ chối quyền truy cập vào các thư mục con từ một miền nhất định

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.