Home / server / Questions / 402750
In Process
leftcase
Asked: 2012-06-28 07:56:07 +0800 CST

Using FilesMatch to increase security

  • 772

I've been experimenting with the FilesMatch Directive. During my first attempt, I discovered that my default rules (rulesets 1 & 2) didn't allow me to access www.test.com/ but did allow me to access www.test.com/index.php

I presumed this was because the file "/" hit ruleset 1 but not ruleset 2 and so got blocked. I therefore put ruleset 3 in place and everything seems to be working now. I just wanted to ask if anyone had any advice on implementing this directive, and whether or not I've gone about it the correct way?

#Ruleset1
<FilesMatch "^.*$">
        Order Deny,Allow
        Deny from all
</FilesMatch>

#Ruleset2
<FilesMatch "^.*\.(css|html?|js|pdf|txt|xml|xsl|gif|ico|jpe?g|png|php?)$">
        Order Deny,Allow
        Allow from all
</FilesMatch>

#Ruleset3
<FilesMatch "">
        Order Deny,Allow
        Allow from all
</FilesMatch>
apache-2.2

1 Answers

  1. This likely isn't working as you're intending.

    Your last match effectively overrides the other rules and allows all requests; "" will always match everything (as will your first section, "^.*$").

    Just using <FilesMatch> seems like the wrong approach for what you're going for, but can you clarify what you're trying to achieve?

    Edit:

    Something like this should function for both cases:

    <Location />
    Order deny,allow
    Deny from all
</Location>
<LocationMatch "(/|\.css|\.html?|\.js|\.pdf|\.txt|\.xml|\.xsl|\.gif|\.ico|jpe?g|\.png|\.php)$">
    Allow from all
</LocationMatch>
    • 1