Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

The web application I use (Zenphoto) stores images in /albums and subfolders. It's backend needs r/w-access to those folders and I need r/w-access to the folders via ftp, but the frontend never looks into /albums.

Now I want to keep visitors from directly accessing /albums and all subalbums

I did a lot of research and found that a .htaccess in /albums with deny from all would accomplish that. However, I would prefer a redirection to my 404 page. What I made from a similar use case is I could do that in my root's htaccess. I added

RewriteRule ^albums/.* /404 [R,NC]

Because the similar usecase was very different in terms of motivation, my questions are:

  1. Is it an appropriate solution?
  2. Does it really accomplish what I want or can it be circumvented?
share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

The problem with redirecting on a 404 is that depending how the back-end functions may also receive a 404, for ultimate protection your best:

  • chmod 744 or something on the folder
  • disable file listing
  • block folder in robots.txt
  • make a blank index.html
  • Use meta noindex, nofollow within the index.html for example protection.

Using the above then its very unlikely they will guess the file names, its not something bots really do. Additional measure could be using a passwd .htaccess based authentication system but this could be over kill. Remember if they can't see the files they can't access them without knowing the file name and if the file-names are long its just as GUESSING a extremely large password - It won't happen.

share|improve this answer
    
Thanks, bybe. The problem with guessing the filenames is that if you take the path from a displayed image and replace "cache" with "albums" you're pretty much there – on my second question, would you say the redirect is a secure method from keeping people out? –  Seul Mar 18 '13 at 12:36
    
Well a 404 would work but at some point are you going to need to 'fetch' images from albums? if so then this will be a problem, otherwise that would work. but also so would passwd .htaccess least that way its impossible to access and in the backend you'd be prompted for the password too. –  bybe Mar 18 '13 at 13:03
    
I don't have run into problems with this setup, even when fetching images into cache. Maybe backend uses a different url to access albums? Thanks for the alternative suggestions though, and in case I should run into problems I will implement your pwd-suggestion! –  Seul Mar 18 '13 at 13:10
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.