Home / server / Questions / 19177
Accepted
Luke
Asked: 2009-06-04 13:01:37 +0800 CST

How do I prevent directory browsing for all but valid users in .htaccess?

  • 772

I'd like to allow directory browsing for users logged in via HTTP Basic authentication but prevent it for anonymous users. Is there a way to do this using .htaccess?

apache-2.2 security .htaccess

2 Answers

  1. Best Answer
    RewriteEngine on
RewriteCond %{REMOTE_USER} =""
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{REQUEST_FILENAME}/index.html !-f
RewriteCond %{REQUEST_FILENAME}/index.php !-f
RewriteRule .? - [F,L]

    You'll need to chain together as many index.foo types as you use.

    This is assuming that by 'logged in user' you mean someone logged in using HTTP BASIC authentication. If you mean someone logged in to a custom authentication mechanism, you'd need to hook a rewrite map into that, which probably isn't worth the effort; at that point I'd put an index.foo in all of my directories that checked for my custom authentication and sent an index or not, depending.

    • 1

  2. http://httpd.apache.org/docs/2.0/howto/htaccess.html

    Explains exactly how to do that. The Require parameter will be what you want to look at.

    • 0