How to restrict access to a file or files using .htaccess?

Question

I want to restrict access to a file or files using .htaccess file. Basically, no one should be able to download file(s) using direct link to the file. However, the file should be accessible from my website.

For instance, say I have a file called Presentation.ppt. I want the visitor to have access to it through my website, but if they try to download it or access it using direct link then the server should reject the request.

Is it possible to do that using .htaccess?

Thank you in advance,

When you say "through my website", what do you mean exactly? Is your site using special forms of telepathy rather than URLs to access the file? — Lior Cohen, Sep 28 '12 at 19:55
@LiorCohen, No Sir. I mean this file should only be accessible through my webpage or HTML file(s) not by calling its direct link URL. — ThN, Sep 28 '12 at 19:59

mr_plum · Answer 1 · 2012-09-28T20:29:32.417

1

You can deny access to the directory for every IPA but the server's:

<Directory /dir/of/presentation>
    Order Allow,Deny
    Allow from 127.0.0.1
    Deny from All
</Directory>

That wonk work, as you pointed out.

How about using Mod Rewrite with a rule that maps /dir/of/presentation/* to a forbidden page. That way a direct link won't work. A request for http://site/content/presentation.ppt
could get redirected to http://site/forbidden.html

Internally, you could make a link to http://authorizedRequest/presentation.ppt map to http://site/content/presentation.ppt

It's just security through obscurity. It wouldn't prevent anyone from typing your "secret" URI into their browser directly.

edited Sep 28 '12 at 20:29

answered Sep 28 '12 at 20:00

mr_plum

2,448
1
18
31

And how are the 'visitors' (legitimate ones) meant to access the files then? – arkascha Sep 28 '12 at 20:02
After re-reading your question carefully, I see that my solution will not work. You want the file to be directly accessible by its URI only if they click a link on your site. I know of no secure way to do that. – mr_plum Sep 28 '12 at 20:17
@nunzabar, I see. You are right that there seems to be no straight forward way to do this. I remember visiting certain websites where you can view their images on their website (webpage) but if you try to access the image itself by calling its direct URL it will redirect you to forbidden.html or page. That sort of what I am trying to achieve. – ThN Sep 28 '12 at 20:36

score 1 · Answer 2 · edited Jun 20 '20 at 09:12

For instance, say I have a file called Presentation.ppt. I want the visitor to have access to it through my website, but if they try to download it or access it using direct link then the server should reject the request.

Is it possible to do that using .htaccess?

It's possible but there's ways to get around it. You need to check against the referer sent by the browser, but anyone can spoof that and sometimes a browser may choose to not even include a referer.

If you are trying to protect the file Presentation.ppt, put these rules in the htaccess file in your document root:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^(https?://)?your_website.com
RewriteRule ^/?path/to/Presentation.ppt - [L,F]

If you want to protect a folder /path/images/ then:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^(https?://)?your_website.com
RewriteRule ^/?path/images - [L,F]

score 1 · Accepted Answer · edited May 23 '17 at 12:33

Thank you all for your answers. I have tried all of your suggestions, but I still couldn't get it working. However, I did come up with a solution that does work.

Step 1: Disable or turn off Option Indexes on your web server by removing the word indexes leaving everything else the same. In some instances, you may be able to do this using .htaccess file. If you are unable to do this with .htaccess, then you will have to look for httpd.conf file in your server. It is usually located at etc/apache/httpd.conf or etc/httpd/conf/httpd.conf. Once you find it, turn this option off in there.

Step 2: Create a folder within your webpage folder and call it whatever you want but make sure it is not easily guessable or that it is obvious (i.e. Joe33CompanyOCT2MeBoss). Then, move the files you want to hide or protect from your visitor into this folder.

Step 3: Within robot.txt file, disallow all bots or crawlers from indexing your folder or the files within this folder by entering, "Disallow yourfoldername."

Step 4: Then you will have to create a PHP file using a similar code below. The code below will force download.

        $File1 = 'http://yourwebsite.com/Joe33CompanyOCT2MeBoss/Presentation.ppt';
        header("Content-Disposition: attachment; filename=\"".basename($File1)."\"");
        header("Content-Type: application/force-download");
        ob_end_clean();
        flush();
        readfile($File1);
        exit;

This way direct path to the file is hidden from your visitor and even though they can download the file directly they simply don't know the actual URL to the file, because force download php code doesn't reveal the actual path to the file. So, now my visitors to my website has to go through my webpage for downloading this file instead of directly.

Following stackoverflow questions have been very instrumental in helping me solve my programming issues. Thanks,

How to Automatically Start a Download in PHP?

php file force download

score 0 · Answer 4 · answered Sep 28 '12 at 20:00

The easiest (though not bulletproof) is to redirect the user agent when the HTTP_REFERER is not correct. This can be done using mod_rewrite in the server configuration or (second choice) inside a .htaccess like file. It helps against simply hotlinking (links referencing your file by url).

You should read the fine documentation of moapaches d_rewrite.

How to restrict access to a file or files using .htaccess?

4 Answers4