I ran into the following issue:
On a website I want to prevent "unauthorized" access to a set of .xml files - the user has to authenticate first. Now it would be possible for an authenticated user to type the URL of the file I don't want them to see. To prevent this, I created a simple php script that checks user authentication, then serves up the XML (with appropriate Content-type
header).
At the same time, I put the following in the .htaccess
file in the directory with .xml
(and other) files:
<Files ~ "(.xml)">
Order allow,deny
Deny from all
Allow from xx.yy.zz.tt (IP address of server)
</Files>
This did the trick - .xml
files were not longer "directly accessible", even for an "authenticated" user. But here is the thing I don't understand:
If I leave out the
'Allow from'
line, the php script still manages to access the.xml
files. It seems that the.htaccess
is completely ignored when it comes to php.
So my question is two fold:
- Is this expected behavior?
- If so, then what method would one use to prevent a php script from accessing a particular file (or group of files)?
There is clearly a fundamental issue around .htaccess
that I completely failed to grasp. Thanks for your insights.