Hello list!
I am working on a admin site and I'm using htaccess for access
restrictions. I have a script that generates the htaccess file and I
think it is pretty secure but I want to have yours opinions..
I use ip restrictions, and cookie restrictions. I use standard php
session for generating and setting session cookie. The .htaccess file
generated looks like this:
#----------------------------------------------------------
RewriteEngine on
Order deny,allow
deny from all
allow from 80.80.80.80 90.90.90.90
RewriteRule .* - [E=REMOTE_USER:user1,E=PHP_AUTH_USER:user2,C]
RewriteCond %{HTTP_COOKIE} !^.*PHPSESSID=aaaabbbbcccdddeeefff111222333.*$
RewriteRule .* - [E=REMOTE_USER:user2,E=PHP_AUTH_USER:user2,C]
RewriteCond %{HTTP_COOKIE} !^.*PHPSESSID=9999888777666555444332211aabb.*$
RewriteRule .*$ - [F]
ErrorDocument 403 /index.php?error403
ErrorDocument 404 /index.php?error404
#----------------------------------------------------------
Is this a secure way of doing this? Is there anything I can do
different or more secure? The REMOTE_USER and PHP_AUTH_USER variables
needs to be set for making some admin tools inside the .htaccess admin
dir work. Like trac..
In front thanks,
Lars
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
" from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|