Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Is there any possible way to setup and restrict access web server to specific set of URLs only. I want my web server only respond to www.abc.com, www.abc.com/videos, www.abc.com/videos/vandor-1, www.abc.com/discussionfrom.

share|improve this question

migrated from security.stackexchange.com Feb 21 '13 at 18:07

This question came from our site for Information security professionals.

1  
what does this have to do with mod_secuirty? What is "webserver"? –  Rook Feb 21 '13 at 15:59
    
webserver is Linux Apache with cpnael –  nasir Feb 21 '13 at 16:22
    
Is it critical that you restrict by URL? What about IP? And is there a reason you don't just put a firewall in front? –  Mark C. Wallace Feb 21 '13 at 17:43
add comment

4 Answers 4

I want my web server only respond to...

I suspect that you don't really want to do that at all - ni fact by the time your webserver sees the URL in a request it is already in conversation with the client (hence it's actually rather difficult to interrupt the packet exchange). At a guess you mean you only want your server to make valid responses to these URLs, and to respond with errors to other URLs.

The solution is simple - ONLY CONFIGURE THESE VHOSTS and THESE PATHS within the vhosts. And disable anything which negotiates URLs (such as auto indexing).

share|improve this answer
add comment

This depends on what HTTPD you are using. I will make a wild guess that you are using Apache (correct me if I am wrong). In all folders that you do not want someone to access put an .htaccess file that contains this line:

deny from all

share|improve this answer
    
thanks Really appreciate quick reply yes i am using Linux server with Cpanel on it , but i am having hard time to get rip of mini skrip kiddies . one of my url is using propduct id = 1 and they chnage url to prosuct di = 13-12 , How i can address this –  nasir Feb 21 '13 at 16:05
    
Can you please advice on this please –  nasir Feb 21 '13 at 16:41
add comment

A simplest solution will be to configure mod security in a reverse proxy mode to have web server independent configuration. Second part is to map URL to your Filesystem Locations following is a simple example from Apache HTTP Server Documentation.

ProxyPass /foo/ http://internal.example.com/bar/
ProxyPassReverse /foo/ http://internal.example.com/bar/

"When clients request documents under the /foo/ directory, the server fetches those documents from the /bar/ directory on internal.example.com and returns them to the client as if they were from the local server" [Apache HTTP Server Documentation] .

share|improve this answer
add comment

This question really belongs better to webmasters.se and I can see it moved soon. Still, in one of your comments you asked how to allow only one parameter value in your Apache config, and thought to give you an example:

RewriteEngine On 
RewriteCond %{REQUEST_URI} (?|&)productid= [NC]
RewriteCond %{REQUEST_URI} !(?|&)productid=1(?|$) [NC]
RewriteRule ^(.*)$ - [F]

This rule will only apply in cases where a request URL parameter productid exists, but isn't exactly 1 (URL ends with it or the next parameter begins). It will issue a Forbidden response if both conditions (and only both of them, notice the lack of [OR] between conditions to concatenate them) are true. There are other ways of achieving same thing, but this one popped out my head now, before this thread is moved to where it belongs. Cheers! ;)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.