In my page admins-only section is very responsive, so I have to use both server and client side templating.

Obviously server side templates are stored outside of web-root and routing takes care of loading them. However now I need to GET a bunch of templates for javscript part.

One approach is to put client side templates in web-root, therefore they can be easally grabbed without even touching my frameworks routes. There is not any sensitive information really hidden in thouse templates alone.

But it feels bad to leave them public. The only way to avoid this I could think up is to make a separate route for each template. Make sure admin is logged in and then do "echo file_get_contents('template.twig');"

However hitting DB for each request to log in is slow, and maintaining a bunch of file_get_contents is a nightmare. I'm looking for a good solution. Or simply leave them public? (I am using PHP, Twig and Twig.js)


Usually static resources are served from within the web root and are findable by unauthenticated users.

If there's no sensitive information stored in these files (and from a security point of view I'd say that there shouldn't be) then this shouldn't really be a problem. An attacker could view the contents of the file if they can guess the URL for a valid resource, but if the files have no security significance it shouldn't really matter...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.