Denying access from domains

Deny rule doesn't work for them

[kaidok]

Right now I have the following on my httpd.conf file:

<Directory /usr/local/apache/htdocs/var>
Order deny,allow
Deny from localhost
</Directory>

(Yes, I know it's extremely stupid to deny access from localhost, anyway I'm just testing Apache functions by the moment).

Anyway I can access the var directory normally from a link in the initial page, even though this rule is set.

I had thought that maybe apache didn't consider localhost as a domain, so I have created a dummy blogspot blog whose only content is a link to [localhost...] and I have put in the httpd.conf file "Deny from blogspot.com", anyway when I press the link of the blog it can access normally.

Is there something that I'm missing?

[jdMorgan]

Did you completely flush your browser cache after adding/changing the code?

If the page is successfully loaded by your browser (e.g. from an "allowed" doamin), and you subsequently request it from "a different domain," then your browser will serve the previously-cached version instead of sending the request to your server. If the request isn't sent to the server, then server-side code can have no effect.

Jim

[kaidok]

Yes, I did, but it doesn't make any difference. Anyway I don't think the problem is related to that because if I put Allow from 127.0.0.1 or Deny from 127.0.0.1 in my httpd.conf file I just have to restart apache server for every change to get the correct result, there's no need to close browser or flush cache.

[jdMorgan]

Make sure your server has access to a DNS server, and that localhost will be returned if 127.0.0.1 is queried.

Closing the browser generally does not flush the cache. Cached pages will remain until you flush it or delete it, or until some other pages displaces the cache entry based on whatever cache replacement algorithm your particular browser uses, whether that is oldest-entry first, or least-used first.

I'll confess that I've never tried Deny from localhost, so I don't know why this isn't working. As long as you are expecting the Deny to work based on the Remote_Host and not on the HTTP_Referrer, it should work as expected with "real" domains on any server that can make and receive responses to DNS requests.

Jim

[kaidok]

Nah,I've checked all what you are saying but it doesn't work...sigh... Well, thanks for your help, anyway. I think I'll try this on another computer to see what happens.