Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I asked how to prevent not logged in users from seeing certain content but the solution I chose to implement encountered a problem. I chose to make my root directory for the server C:\WAMP\www\public and to include the files I only want logged in users to see from C:\WAMP\www\private. The problem is if I have a script that needs to be interpreted by the server (such as .php) that I don't want the public but if I put them in private the server won't run them and if I put them in public then anyone can access them. Should I abandon this approach with private and public and use .htaccess instead? In the second link a suggestion was to make a file in the public directory that includes the script in the private directory but I think that's getting too messy. Any better solutions?

Come to think of it there really is three levels of security

  1. Content anyone can see (e.g. the registration page)
  2. Content only logged in users can see (e.g. the members only section)
  3. Content no one can see (e.g. scripts that add user accounts or make calls to the database - hold on is this even a security breach if anyone can see these sorts of things?)
share|improve this question
add comment

closed as off topic by AJ Henderson, dr jimbob, Scott Pack, Rory Alsop Feb 20 '13 at 11:54

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 2 down vote accepted

It seems like there might be some weird things or misunderstandings going on here. A web server will only present files to a user that it is instructed to provide. By default, on many web servers, this is any content that it does not have a means of processing directly, thus any files in the web folder end up being publicly visible. However, in the case of a properly configured server side script file such as PHP, the server should instead pass the file to a handler (PHP) to be interpreted and then provides the output of that script to the client requesting the "file".

In general, your script handlers will run as a separate user from the web server. The scripting engine needs to have access to whatever files it needs to be able to execute on and the web server simply needs to be able to call the scripting engine. In this way, you can have script files which PHP can get to that the web server does not have access to. Additionally, this should allow you to have PHP files interpreted wherever the URL that points to them may be. You simply have to ensure that the binding to the scripting engine is properly configured.

As for the specifics of configuring on your particular server, Webmasters might be of more assistance since they have a wider set of experience with particular web server applications and script handlers aren't really directly a security concern.

share|improve this answer
    
Let me re-explain back to you to make sure I understand. The webserver functions independently of the scripting engine (the thing that interprets PHP). So I can get the scripting engine to interpret files in private and public and the webserver only to host public. –  Celeritas Feb 8 '13 at 19:19
    
It wouldn't surprise me if I have a misunderstanding but could you say what you think the misunderstanding is? –  Celeritas Feb 8 '13 at 19:24
    
@Celeritas - well most likely it already can, but you'd also need to work out the binding so that when a user was logged in, the web server would request that the script being requested be executed. I'm not really sure how the public/private thing works on your particular web server though. I mostly do IIS configuration on the web master side of things. –  AJ Henderson Feb 8 '13 at 19:27
    
Just to clarify the public/private thing is something I made in the sense I just happened to name directories public and private and set the web root to public. I'm using WAMP (so not a real server). –  Celeritas Feb 8 '13 at 19:30
    
@Celeritas - ah, well there is no particular reason that you shouldn't be able to have it process files in the "private" folder and have PHP still process it, though I can't really help you with the specific configuration details as I don't know WAMP. The idea is that you want the web server to only fulfill the request to the URLs for private folder if the user is logged in, but PHP should have access to run on either path. –  AJ Henderson Feb 8 '13 at 19:33
show 1 more comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.