2

I'm using .htaccess to control source IP of connections to my web application. My configuration looks more or less like this:

order deny,allow

deny from all

allow from X.Y.Z.Q

These days we can trust less and less things, every days some commonly used technique is found to be vulnerable. So I started to ask myself questions:

  1. Is this method really save and sufficient?
  2. Should I employ some additional mechanism to protect my web-app better?

I am using Apache 2.2.24 and PHP 5.4.17 in Fast-CGI mode.

Thanks in advance!

2

This method is sufficient to protect against Apache serving this directory, but a configuration error may disable this:

  • If your main Apache configuration contains AllowOverride None (or similar), then .htaccess files are ignored. Thus your IP whitelist does not apply. Depending on the hostname or directory, different configuration might be set.
  • If you have Satisfy any set (not default) and a client is authenticated with the server, then it is still granted access.

Furthermore, there are other attack surfaces that may bypass your IP restrictions:

  • On a shared webserver, it might be possible for other users of the server to access your files over the filesystem, bypassing Apache.
  • If your webapp does not use HTTPS, it is already vulnerable to sniffing and MitM attacks.
  • Your app could still be vulnerable to CSRF. If someone knows that a particular app is running on this host, (s)he could trick you into opening a page that exploits a CSRF vulnerability in your app (if any).

Suggestions:

  • If this is a dedicated server for this webapp, configure the firewall to whitelist your IP addresses for this port. Remember to check your IPv6 configuration as well.
  • Ensure that file permissions are correctly configured. Should any service (running as a different user that is not root) on your server be compromised, then your app should still be safe (providing there are no privilege escalation bugs).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.