Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [htaccess]

.htaccess is a configuration file for use on web servers running the Apache Web Server software.

0
votes
2answers
79 views

Could Someone Use a Stolen Cookie Session ID to Bypass Htaccess Login?

I'm doing some pen testing for my place of employment. I was able to grab the session id from the browser cookies, but i still cannot get past the htaccess login. I initially thought that by setting ...
2
votes
1answer
53 views

HSTS and TLS redirection: What is the correct order?

Currently I am trying to setup my apache server for HSTS. Therefore my .htaccess looks like this: <IfModule mod_headers.c> Header set Strict-Transport-Security "max-age=63072000; ...
1
vote
1answer
80 views

.htaccess rewrite rule to hide files

Let's say we have a password.txt in a webdirectory that must not be leaked. Is it secure to use a RewriteRule like this? RewriteRule "^password.txt?*" "404.html" I tried to do something fishy like ...
0
votes
0answers
56 views

How to prevent users to access my files?

I run a magento shop and figured out that there is a security risk. Users can download the logfiles under /var/log/. If they go to https://www.example.com/var/log then a 404 site shows but if they ...
1
vote
0answers
16 views

Is HSTS necessary or can I just write .htaccess code to always redirect http to https? [duplicate]

Is HTTP Strict Transport Security (HSTS) necessary or can I just write regular .htaccess code to always redirect http to https?
1
vote
1answer
92 views

HSTS vs RewriteRule

I've recently read that HSTS is designed to avoid some of the vulnerabilities associated with htaccess redirects to force HTTPS, because the browser can be made to ignore them. That said, many of our ...
1
vote
1answer
667 views

X-Frame-Options header on redirect

I have several web applications running on my server (Debian 8 running Apache). One of my customers wants to improve the security of his app, after having some security audits carried out by a third-...
1
vote
0answers
71 views

How to deny execution of any file on a specific directory?

I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the ...
1
vote
2answers
523 views

Can someone view the contents of my .htaccess file

I am storing hashed passwords in a file called passwords.htaccess. When a user fills out a login form, the passwords are checked. I am getting the contents of passwords.htaccess with file_get_contents(...
0
votes
1answer
465 views

Is there any way to bypass .htaccess PATH restriction (in URLs)?

We use .htaccess to deny direct access to specific file example.com/myfile.txt, by using this configuration: RewriteEngine on RewriteCond %{THE_REQUEST} myfile.txt RewriteRule ^ - [F,L] The ...
1
vote
2answers
342 views

Override parent .htaccess with php.ini?

Is it possible to override parent folder .htaccess rules with child php.ini or some other file except .htaccess? What I have is: /var/www/site/static/.htaccess /var/www/site/static/abc/ /var/www/site/...
1
vote
1answer
80 views

Apache RewriteRule htaccess security

If I configure an .htaccess file like this : RewriteEngine On RewriteRule ^([^/]*)$ /view.php?key=$1 [L] Which transforms: original URL http://www.example.com/view.php?key=123 rewritten URL http:...
2
votes
5answers
3k views

Protect against attack that modifies .htaccess?

I have a dedicated server. There is no code/site live now, only a coming soon page. A few minutes ago I realized that someone has changed the .htaccess file. How can I protect against that kind of ...