These are the general appliable steps of configuring an MVC-based web application. Presumed web server version for the settings below: Apache HTTP Server v2.4.
1) Block access to all directories and files:
First of all, in the config file of Apache, the access to all directories and files should be blocked by default:
# Do not allow access to the root filesystem.
<Directory />
Options FollowSymLinks
AllowOverride None
Require all denied
</Directory>
# Prevent .htaccess and .htpasswd files from being viewed by Web clients.
<FilesMatch "^\.ht">
Require all denied
</FilesMatch>
2) Allow access to a default directory:
The access to a default directory (here /var/www/
), supposedly used for projects, should then be allowed:
<Directory /var/www/>
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>
My recommendation: For security reasons, this location should contain only a index.php
and a index.html
file, each of them displaying a simple "Hello" message. All web projects should be created in other directories and the access to them should be set separately, as described below.
3) Set access to a separate project directory:
Let's suppose that you create your project in another location (like in the directory /path/to/my/sample/mvc/
) than the default one (/var/www/
). Then, taking into consideration, that only the subfolder public
should be accessible from outside, create a web server configuration for it, like this:
ServerName www.my-sample-mvc.com
DocumentRoot "/path/to/my/sample/mvc/public"
<Directory "/path/to/my/sample/mvc/public">
Require all granted
# When Options is set to "off", then the RewriteRule directive is forbidden!
Options FollowSymLinks
# Activate rewriting engine.
RewriteEngine On
# Allow pin-pointing to index.php using RewriteRule.
RewriteBase /
# Rewrite url only if no physical folder name is given in url.
RewriteCond %{REQUEST_FILENAME} !-d
# Rewrite url only if no physical file name is given in url.
RewriteCond %{REQUEST_FILENAME} !-f
# Parse the request through index.php.
RewriteRule ^(.*)$ index.php [QSA,L]
</Directory>
Note that the above settings can be defined either:
- in the config file of Apache, or
- in a .htaccess file inside the project, or
- in a virtual host definition file.
In case a virtual host definition file is used, the settings must be included between the tags <VirtualHost>
and </VirtualHost>
:
<VirtualHost *:80>
... here come the settings ...
</VirtualHost>
Note: Don't forget to restart the web server after each change of the configuration settings.
Some resources: