Prevent access to php files (folder) with .htaccess EXCEPT for XMLHttpRequest

Question

I have a folder www.mysite.com/page/panel/soascripts/ where there are 10 different PHP files. I want to prevent access to the folder soascripts and the php files in it. Except X-Requested-With = XMLHttpRequest (for ajax). Is this possible with htaccess?

Why bother? Are people likely to stumble across it and be confused? Adding an X-Requested-With header is trivial if any attacker wants to do something nefarious with the data. — Quentin
– Quentin, Commented Jan 13, 2014 at 17:04
Well, I just want it. In my logs I already saw some accesses. I don't want it as a single security option, I already implemented an authorization secr. (I know that an attacker can easily manipulate the header) but I want this for regular users. They should not stumble in this directory. — Kallewallex
– Kallewallex, Commented Jan 13, 2014 at 17:09

Jon Lin · Accepted Answer · 2014-01-13 17:19:30Z

2

In the htaccess file in your soascripts folder:

RewriteEngine On
RewriteCond %{HTTP:X-Requested-With} !=XMLHttpRequest
RewriteCond %{HTTP:X-REQUESTED-WITH} !^(XMLHttpRequest)$
RewriteRule \.php$ - [L,F]

So without the

X-Requested-With: XMLHttpRequest

request header, the response will be a 403 forbidden.

EDIT:

If you want to add the rules to the document root, you just need to include the path:

RewriteCond %{HTTP:X-Requested-With} !=XMLHttpRequest
RewriteCond %{HTTP:X-REQUESTED-WITH} !^(XMLHttpRequest)$
RewriteRule ^page/panel/soascripts/[^/.]+\.php$ - [L,F]

Make sure to add it before any type of routing rules (like stuff being sent to index.php).

edited Jan 13, 2014 at 17:19

answered Jan 13, 2014 at 17:12

Jon Lin

144k29 gold badges227 silver badges224 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Quentin Over a year ago

It's sub-optimal practise to have any .htaccess files.

Kallewallex Over a year ago

JonLin Thank you. @Quentin I don't have a lot of directories or files. I just want to prevent anyone from display-raping the php files and I don't know how else to archive this. hm, I've read the article.... will this also slow down my php mysql queries to my database in the soascripts folder?

Collectives™ on Stack Overflow

Prevent access to php files (folder) with .htaccess EXCEPT for XMLHttpRequest

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related