0

I have a question about file permissions of html - css files served by httpd (on CentOS).

I have a website with several html - php - css files. When a user enters the URL of my website, index.html is displayed as it should. I tried to browse one of my css files (just for fun), and I realized that css source code is displayed in the browser. I do not publish the css files and their exact names of course, but some names (e.g style.css , bootstrap.css etc) are trivial, and one can try and get the styling of my webpage easily.

What is the solution to that? I cannot take off the read permissions of these files, because apache would not style the html files (since it will not be able to read the css).

Improve this question
11
  • You mean you are going to hide your css files name? Commented Jun 11, 2014 at 8:24
  • I want to prevent css source code from being displayed. I want it just to be used from apache to style the html. I could possibly change the .css files to non-predictable names, but I believe that I could just let them as they are, and prevent them from being displayed when someone tries to access them. (e.g via a url like <my_syte>/css/style.css) Commented Jun 11, 2014 at 8:33
  • Why do you want to hide your CSS files from public? Since the browser will have to download it at some point any user will also be able to receive the file. You can use server side technology and place your CSS inline, but that will also not hide the definitions itself and it would be poor practice. You can obscure your css by compressing it, but developer tools will make it readable very neatly anyways. When you don't want it to be downloadable, don't upload it in the first place. Commented Jun 11, 2014 at 8:46
  • Yes of course css is downloadable and one can view the styling of my html. But this is not the same as viewing the whole .css file. Css files have comments and are well structured (at least my css :) )and one can copy the file as a whole and use the code as it is. And the smae stands for javascript files. Commented Jun 11, 2014 at 8:52
  • 1
    You should not be worried that someone can view the source then. When you don't want your comments to be made public, use a CSS preprocessor like SASS or LESS. You can prevent your comments from beeing used in the resulting .css file. Commented Jun 11, 2014 at 9:00

1 Answer 1

Reset to default
0

There's no solution to that, css files must be readable and downloadable. You can minify them if you want them to be less readable (and smaller which is its real use).

Edit: Relevant Answer

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.