On my webserver I would like to block all files except some reasonable exceptions. I have following Filesmatch directive which is doing it's work:
<FilesMatch "(?<!\.txt|\.htm|\.html|\.css|\.php|\.js|\.jpg|\.png|\.gif|\.ico|\.svg|\.eot|\.ttf|\.woff|\.otf)$">
Order Allow,Deny
Deny from All
</FilesMatch>
Note this FilesMatch uses a negative lookbehind regular expression: see http://www.regular-expressions.info/lookaround.html. It will block all files except those having an extension as stated.
This results also in an 403 Forbidden for the directory default document (index.html). This is not what I want. Can someone help? How does the default document lookup work? Is there another solution to blocking all except some? I looked in Apache2's error log with LogLevel debug, but the only message is "client denied by server configuration" when asking for a default document. (Explicitly asking for the index.html works)
Edit: there is a solution to this by using the Location directive. See Using FilesMatch to increase security So my problem is solved, but I still would like to know why it does not work with FilesMatch.
0 Answers