Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improved .htaccess security and readability #1404

Open
wants to merge 3 commits into
base: next
Choose a base branch
from

Conversation

Raruto
Copy link
Contributor

@Raruto Raruto commented Jan 24, 2021

List of changes

  • added section comments
  • added deny rules for the following files:
    • composer\.(json|lock)
    • package\.json
    • (README|CONTRIBUTING)\.md
    • Dockerfile
    • LICENSE
    • "hidden" files and directories (whose names begin with a period)
  • removed multiple <Files> statement in favor of a single <Filesmatch> statement

Additional info

For those interested in deepening I suggest you start reading one of the following examples:

Have a nice Day,
Raruto

@Raruto
Copy link
Contributor Author

Raruto commented Jan 24, 2021

PS regarding these two issues:


Some apache (shared) hosts don't allow you to override Options directives (thus getting the error 500: Options not allowed here ... within server logs):

# sample "httpd.conf" with "AllowOverride" set to "None"

<Directory "/var/www/localhost/htdocs">
    Options Indexes FollowSymLinks MultiViews
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

As there is no easy way to verify those directives and prevent 500 error (without access to error logs or apache config files), would it make sense to keep them both commented by default?

Options -Indexes

Options -MultiViews

as it happens for the RewriteBase directive:

# RewriteBase /

Raruto added a commit to Raruto/cockpit-blog that referenced this pull request Feb 6, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant