1

In the past I have used two methods for securing files for web apps.

  1. Put them outside of webroot (which is usually {www || http}/app). So files would usually be stored outside apache altogether.

OR

  1. Restrict access within my .htaccess file

My friend suggested another alternative which is similar to option 1 but allows all files to remain together. He suggested that when setting up my virtual host I adjust the path to {www || http}/app/public.

This option would allow me to store all related files in {www || http}/app and just store all private files in {www || http}/app/private

Should there be any concerns with this method?

3
  • I'm not sure if I understand you. Isn't this basically suggesting that you use a different webroot for the virtual host (i.e. .../app/public instead of .../app) and then having the private files outside the webroot - i.e. exactly the same as option 1, only with a different webroot? Sep 14 '20 at 17:38
  • Yes, you are correct. It should be self explanatory but I have been caught with "gotchas" before and always like to confirm new information. Sep 14 '20 at 17:47
  • 1
    I understand. In this case - this is exactly the same as option 1 only with a different webroot and thus it provides the same security. Sep 14 '20 at 18:11
1

Answer from @SteffenUllrich

This is exactly the same as option 1 only with a different webroot and thus it provides the same security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.