Restrict webserver access to specific set of URLS only

Question

Is there any possible way to setup and restrict access web server to specific set of URLs only. I want my web server only respond to www.abc.com, www.abc.com/videos, www.abc.com/videos/vandor-1, www.abc.com/discussionfrom.

Answer 1

I want my web server only respond to...

I suspect that you don't really want to do that at all - ni fact by the time your webserver sees the URL in a request it is already in conversation with the client (hence it's actually rather difficult to interrupt the packet exchange). At a guess you mean you only want your server to make valid responses to these URLs, and to respond with errors to other URLs.

The solution is simple - ONLY CONFIGURE THESE VHOSTS and THESE PATHS within the vhosts. And disable anything which negotiates URLs (such as auto indexing).

Answer 2

This depends on what HTTPD you are using. I will make a wild guess that you are using Apache (correct me if I am wrong). In all folders that you do not want someone to access put an .htaccess file that contains this line:

deny from all

Answer 3

A simplest solution will be to configure mod security in a reverse proxy mode to have web server independent configuration. Second part is to map URL to your Filesystem Locations following is a simple example from Apache HTTP Server Documentation.

ProxyPass /foo/ http://internal.example.com/bar/
ProxyPassReverse /foo/ http://internal.example.com/bar/

"When clients request documents under the /foo/ directory, the server fetches those documents from the /bar/ directory on internal.example.com and returns them to the client as if they were from the local server" [Apache HTTP Server Documentation] .

Answer 4

This question really belongs better to webmasters.se and I can see it moved soon. Still, in one of your comments you asked how to allow only one parameter value in your Apache config, and thought to give you an example:

RewriteEngine On 
RewriteCond %{REQUEST_URI} (?|&)productid= [NC]
RewriteCond %{REQUEST_URI} !(?|&)productid=1(?|$) [NC]
RewriteRule ^(.*)$ - [F]

This rule will only apply in cases where a request URL parameter productid exists, but isn't exactly 1 (URL ends with it or the next parameter begins). It will issue a Forbidden response if both conditions (and only both of them, notice the lack of [OR] between conditions to concatenate them) are true. There are other ways of achieving same thing, but this one popped out my head now, before this thread is moved to where it belongs. Cheers! ;)