What are the options to share unfinished web-page with a customer without allowing third-party to see the work in progress when developer has control over the web-server? I could come up with following:
- Configure web-server to listen on some random port. For example, this means that web-site is accessible from
http://www.example.com:48080. However, one is able to detect the web server easily with port scan and access the web-site.
- Make the content available only if it is prefixed with a unique string. However, this does not protect against fuzzers. Example using Apache
# Web-page is available from https://example.com/5d15d58b294ee/index.html # while https://example.com/index.html sends HTTP status code 403(forbidden). # Probably easier approach would be to move all the web-page files to directory named 5d15d58b294ee. RewriteRule "^/5d15d58b294ee/(.*)" "/$1" [L] RewriteRule "^/.*" - [F,L]
- Use authentication. For example, Apache basic authentication.
Out of those three options, the third one seems to be the most secure. However, the second one is probably more convenient and maybe usually secure enough.