5

If you assume that you're not on HTTPS or that, at least, the security of your connection is compromised, is it safe to email someone the contents of your site's .htaccess file?

I'm a novice in this area so I'm curious as to the possible dangers of doing this. Examples would be great!

4
  • depends I guess, emailing anything that regulates access is a bad idea, you will give people a map on how to by-pass your htaccess
    – TheHidden
    Nov 19 '15 at 15:11
  • 1
    Use dropbox and send them a link. It's more secure than just email yet easy to do. Nov 19 '15 at 16:17
  • @user2077362 Why is dropbox public link more secure? Anyone that intercepts the email with the link will have access to the file
    – Johnny
    Nov 20 '15 at 0:14
  • Unless the Dropbox is password protected. But odds are the password is in one of those emails as well. Nov 20 '15 at 0:44
12

There may be harm in divulging your .htaccess file. This is usually one of the reasons why there's a rule to block access to .htaccess, like this:

<Files .htaccess>
Order Allow,Deny
Deny from all
</Files>

The contents of this file may tell users about your configuration, such as where passwords, certificates, and so on reside in the system, and how various physical directories map to virtual directories, etc. It can expose more about your system then you'd like a typical person to know, and definitely more than you'd like an adversary to know just given to them on a silver platter.

While there's technically no harm from the file itself (as long as users can't modify the version on the server), the .htaccess may give malicious individuals information on how your system might be vulnerable. Do feel free to share this file with people you trust if you need help with it. Sending it by email is still safer than using a public forum if viewers might be able to associate the file with your domain/server, but I'd recommend physically delivering it (in person!) on portable media if it's reasonable to do so (e.g. sharing it with a colleague you see at work every day).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.