Forum Moderators: phranque
I tried the following:
<FilesMatch "\/directory\/$">
Deny from all
</FilesMatch>
(doesn't block access)
and:
<FilesMatch "\.css$">
Deny from all
</FilesMatch>
(blocks access but my pages have no CSS!)
RewriteCond %{HTTP_REFERER}!^http://(www\.)?domain.com(/)?.*$ [NC]
RewriteRule .*\.(js¦css¦ico)$ [domain.com...] [R,NC]
Question: will this cause a problem for browsers that don't send referer info with page requests?
Also, still can't block access to directories.
Can I ask what you are trying to accomplish by blocking them?
There are a few ways to keep your files from being accessed, and sometimes .htaccess is not the best solution. (Or .htaccess alone is not the best solution might be better wording.)
Justin
PS - Are you SURE about not blocking browsers that don't send referrer info? A site with a code generator adds the following if you don't want to block blank referrers:
RewriteCond %{HTTP_REFERER}!^$
It also includes a warning about such browsers -- see [htmlbasix.com...]
RewriteCond %{HTTP_REFERER}!^$
RewriteCond %{HTTP_REFERER}!^http://(www\.)?domain.com(/)?.*$ [NC]
RewriteRule .*\.(gif¦jpg¦png)$ - [F]
That first line adds a logical "AND" which I think is what you're looking for. So the condition is this: if the referrer value is not null AND it's not ...domain.com, then do the rule. Therefore, it's important to understand that if an agent requests a file and does not pass a referrer, then it's not blocked. This may not be necessary now-a-days though, as the only agents that won't pass a referrer value are really old browsers, and maybe hackers. Just depends on how you want to handle it.
Another major difference though in how I handle it is that in my RewriteRule, I'm using F (forbidden), as this seems more appropriate. This causes the agent to receive a "403 Forbidden" message which is exactly what I want. In your case, using an "R", you're just redirecting the request to a different URL, so you're still serving up content for those requests. Personal preference I suppose.
The goal is to block type-in requests for .js and css files.
Type-in requests, by definition, have no referrer.
So, allowing blank referrers in the code explicitly allows type-in requests for those files.
The best that can be achieved is to block requests for .js and .css files with no referrer, and hope that not too many of your visitors are behind corporate or ISP caching proxies (which also provide no referer):
RewriteCond %{HTTP_REFERER} !^http://(www\.)?domain\.com
RewriteRule \.(css¦js)$ - [F]
Flush your browser cache before testing any changes to your configuration.
Jim
In .html to block one css and 2 js files all 3 files will have to be requested (bad) from your server. Then they will be forbiden.
In .php to block a single comparison can block all 3.
Justin
RewriteEngine on
RewriteRule ^(.*)$ - [F]
As for CSS & JS files, I'll just leave them accessible; I'd rather not block access to legit users whose browsers don't send referer info. I'm guessing this isn't a big issue since there's no clear solution...
...unless someone can get the following different approach to work:
<FilesMatch "\.(css¦js)$">
Deny from all
</FilesMatch>
I've seen lots of different lines in there, like:
Order Allow,Deny
Allow from all
Satisfy all
and:
<Limit GET PUT POST>
Order Allow,Deny
Allow from all
</Limit>
but I don't understand it enough to get it to work. Is that a viable method?
