Multi tool use

Clash Royale CLAN TAG

Apache Server Web directories access restrictions

I have set up an apache server, hosting a website.

For example In my website you can play with an online javascript atari roms. Whenever you load a rom in the website, the javascript temporarily downloads it to your browsers cache.

If you for example write website.com/roms/atari.zip you can download this rom. I do not want this.

Is there a way to forbid direct access to this file but also whitelisting access from within the javascript requests?

Many thank you in advance.

1 Answer
1

Requiring Authorization header is one way to do this.

Creating an authentication user:

/path/to/htpasswd -c /etc/htpasswd/.htpasswd downloaduser


And you'd supply the password. Note that the command above will create a new file, overwriting a previous one.

You would configure it in httpd.config like:

<Directory "/var/www/html/roms">
AuthType Basic
AuthName "Authentication Required"
AuthUserFile "/etc/htpasswd/.htpasswd"
Require valid-user
</Directory>


Then, with XHR request in javascript,

req.setRequestHeader('Authorization','Basic ' + Base64StringOfUserColonPassword);


base64StringOFUserColonPassword is what the name implies, you can get it like window.btoa(username + ":" + password)), or with base64 command line command.

window.btoa(username + ":" + password))

base64

Further reading:

Edit: there are xampp specific instructions for example here: http://chandanpatra.blogspot.com/2013/08/basic-authentication-with-htpasswd-in.html. The process is as I outlined for xampp as well.

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.