You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Andrey Utkin <an...@gmail.com> on 2012/12/25 02:10:08 UTC
[users@httpd] Directory access control by referer and password auth
I need to control access to particular directory with following logics:
if HTTP_REFERER is certain site (but not the same as in requested
document URL), then grant access;
else, authorize by password (i.e. pass basic authentication)
Reading apache 2.4 docs i found there's new directive "If", which seem
to make my task simpler. But now i have httpd 2.2 installed. It is
possible to upgrade, but i'd be grateful for description of both cases
- using latest version features, and way suitable for 2.2.
Thanks for any help.
--
Andrey Utkin
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Directory access control by referer and password auth
Posted by Nick Kew <ni...@webthing.com>.
On 26 Dec 2012, at 11:28, Andrey Utkin wrote:
> Anyone?
See http://httpd.apache.org/docs/2.4/mod/core.html#if
--
Nick Kew
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Directory access control by referer and password auth
Posted by Andrey Utkin <an...@gmail.com>.
2012/12/25 Andrey Utkin <an...@gmail.com>:
> 2012/12/25 Wade Evans <wa...@gmail.com>:
>> Are you certain that this will suit your security needs? HTTP_REFERRER is
>> easy to spoof...
>
> Yes. Thanks for asking, the possibility of spoofing is understood,
> nothing top secret is portected.
Anyone?
--
Andrey Utkin
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Directory access control by referer and password auth
Posted by Andrey Utkin <an...@gmail.com>.
2012/12/25 Wade Evans <wa...@gmail.com>:
> Are you certain that this will suit your security needs? HTTP_REFERRER is
> easy to spoof...
Yes. Thanks for asking, the possibility of spoofing is understood,
nothing top secret is portected.
--
Andrey Utkin
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Directory access control by referer and password auth
Posted by Wade Evans <wa...@gmail.com>.
Are you certain that this will suit your security needs? HTTP_REFERRER is
easy to spoof...
On Mon, Dec 24, 2012 at 5:10 PM, Andrey Utkin <
andrey.krieger.utkin@gmail.com> wrote:
> I need to control access to particular directory with following logics:
> if HTTP_REFERER is certain site (but not the same as in requested
> document URL), then grant access;
> else, authorize by password (i.e. pass basic authentication)
> Reading apache 2.4 docs i found there's new directive "If", which seem
> to make my task simpler. But now i have httpd 2.2 installed. It is
> possible to upgrade, but i'd be grateful for description of both cases
> - using latest version features, and way suitable for 2.2.
> Thanks for any help.
>
> --
> Andrey Utkin
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>