Denial access to file

Question

I want to deny file from being browsed. but still accessible via inside server or the hosting space when called by script I want to deny from people browsing it.

this is the part from the html source

type: "POST",
     url: "filem.php",
     data: {}

so i want to deny it with htaccess from being browsed. but accessible when other files call the page

_"but accessible when other files call the page"_ - that is not actually a thing, on the HTTP level. You could at most check the referrer, but that is highly unreliable. — CBroe, Feb 24 '23 at 15:07

score 0 · Accepted Answer · answered Feb 24 '23 at 15:10

The line of code you supplied seems like a part of a JavaScript code block that sends a POST request to the filem.php script. The .htaccess file cannot directly affect how this JavaScript code operates, but it may impact how the server responds to requests made to the filem.php script.

If you wish to limit direct access to the filem.php script while still allowing it to be accessible by the JavaScript code block that sends a POST request, use the following .htaccess code:

<Files "filem.php">
    Order Deny,Allow
    Deny from all
    Allow from localhost
</Files>

Explanation:

The line Order Deny,Allow indicates that the "deny" rule takes precedence over any "allow" rules.

The Deny from all line prohibits anyone requesting the filem.php script from directly accessing it through their browser.

The Allow from localhost line restricts requests to the filem.php script to the local server only. This implies that the script may still be accessed by other scripts on the server, but not by users directly via their browsers.

If your server has a different name from the local server (for example, 127.0.0.1), you must change localhost with the proper name in the .htaccess file.

OR You can also create a .htaccess file in the directory where the file is located or add the following lines to your existing .htaccess file:

<Files "filem.php">
    Order Allow,Deny
    Deny from all
    <IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_METHOD} POST
        RewriteRule ^ - [L]
    </IfModule>
</Files>

Unfortunately there's quite a lot of misinformation in this answer. Whilst it "might" still work for the OP, it's not going to allow client-side JS requests from local scripts for anything other than the OPs local development machine (if indeed that is using `localhost`) - if we are lead to believe that is the intention from the somewhat vague question. The use of mod_rewrite in the 2nd example is not doing what you think its doing - its not going to permit POST requests as these will still be blocked by "mod_auth...". `Order`, `Deny` and `Allow` are also deprecated on Apache 2.4. — MrWhite, Feb 24 '23 at 18:17

Denial access to file

1 Answers1