0

I created an e-shop with e-books and they are stored in specific folder which is protected by a .htaccess file :

Order deny,allow
deny from all
allow from 127.0.0.1

The IP is the IP of the webpage, so it is inaccessible to anyone except for the scripts. I was thinking about adding .htpasswd, but it seems like overkill.

Is this enough to protect this folder?
Is it possible to spoof the IP so that sooner or later someone will find out the folder and how it is protected?

  • Depending on the code for your webpage, someone could execute some code on your server making the request originate from 127.0.0.1 – BadSkillz Apr 29 '15 at 12:07
  • I hope this is not possible, i create hash for every ebook in order, after the order is payed I send customer link for download, but it is seo link like localhost.com/123hash124 so he can not know which controller and which function actually executes the downloading. – JTC Apr 29 '15 at 12:10
3

Spoofing an IP will not lead to being able to download the files, as the response for this request will be send back to the spoofed ip, which would have to be the servers ip in this case.

However, if an attacker can upload his own php page through slqi or something else, they can send requests that originate from the server itself (so 127.0.0.1) and would bypass the protection on the folder. But this really depends on the code used for the website.

So if the code is solid, this should be enough protection.

  • If the attacker can send a php file, he can use fopen and skip the .htaccess protection entirely. – ThoriumBR Apr 29 '15 at 13:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.