2

The web application I use (Zenphoto) stores images in /albums and subfolders. It's backend needs r/w-access to those folders and I need r/w-access to the folders via ftp, but the frontend never looks into /albums.

Now I want to keep visitors from directly accessing /albums and all subalbums

I did a lot of research and found that a .htaccess in /albums with deny from all would accomplish that. However, I would prefer a redirection to my 404 page. What I made from a similar use case is I could do that in my root's htaccess. I added

RewriteRule ^albums/.* /404 [R,NC]

Because the similar usecase was very different in terms of motivation, my questions are:

  1. Is it an appropriate solution?
  2. Does it really accomplish what I want or can it be circumvented?
Improve this question

1 Answer 1

Reset to default
0

The problem with redirecting on a 404 is that depending how the back-end functions may also receive a 404, for ultimate protection your best:

  • chmod 744 or something on the folder
  • disable file listing
  • block folder in robots.txt
  • make a blank index.html
  • Use meta noindex, nofollow within the index.html for example protection.

Using the above then its very unlikely they will guess the file names, its not something bots really do. Additional measure could be using a passwd .htaccess based authentication system but this could be over kill. Remember if they can't see the files they can't access them without knowing the file name and if the file-names are long its just as GUESSING a extremely large password - It won't happen.

Improve this answer
3
  • Thanks, bybe. The problem with guessing the filenames is that if you take the path from a displayed image and replace "cache" with "albums" you're pretty much there – on my second question, would you say the redirect is a secure method from keeping people out?
    – jshlke
    Commented Mar 18, 2013 at 12:36
  • Well a 404 would work but at some point are you going to need to 'fetch' images from albums? if so then this will be a problem, otherwise that would work. but also so would passwd .htaccess least that way its impossible to access and in the backend you'd be prompted for the password too.
    – Simon Hayter
    Commented Mar 18, 2013 at 13:03
  • I don't have run into problems with this setup, even when fetching images into cache. Maybe backend uses a different url to access albums? Thanks for the alternative suggestions though, and in case I should run into problems I will implement your pwd-suggestion!
    – jshlke
    Commented Mar 18, 2013 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.