1

First off my terminology is probably wrong but when I hear "direct access" I think someone means that anyone has read privileges to a file from the url. Is my understanding of what "direct access" means correct?

I'm using htaccess to prevent direct access to the following directory (The http directory is DocumentRoot /var/www/public_html)

<Directory /var/www/public_html/indirect_access/>
        AuthType Basic
        AuthName "Restricted Access"
        AuthUserFile /passwords/me
        Require user me
</Directory>

I have two files

/var/www/public_html/indirect_access/indirect.php

<?php echo 'hi'; ?>

/var/www/public_html/direct.php

<?php include('indirect_access/indirect.php'); ?>

When someone goes to www.mysite.com/direct.php, the browser prints 'hi'. When someone goes to www.mysite.com/indirect_access/indirect.php they are prompted for a username and password.

However when I change the contents of /var/www/public_html/direct.php to include an AJAX request like

$.ajax({
    url: "indirect_access/indirect.php",
    type: "GET",
    dataType: 'html',              
    success: function(data){      
        $("body").prepend(data);
    },
});

and then I try to access www.mysite.com/direct.php, I'm prompted for a username/pass.

Is it possible to prevent htpasswd from prompting authentication for indirect access to a file via ajax?

user784637
  • 1,482
  • 7
  • 35
  • 51
  • 1
    From the server's perspective, there is no difference between your 'direct' and 'indirect' request. Both are simply GET requests for a particular URL. One possible difference is the HTTP_REFERER - which you can use in your htaccess - however, it is set client side and is easy to spoof. The best approach would probably be to authenticate each request in PHP. See [this question](http://stackoverflow.com/questions/1756591/prevent-direct-access-to-file-called-by-ajax-function) and [this question](http://stackoverflow.com/questions/8421230/php-only-allow-access-via-ajax) for some starting points. – cyberx86 Mar 21 '12 at 00:37
  • @cyberx86 Thanks for the advice. I authenticate each request in PHP for *.php files in `/var/www/public_html/` like `/var/www/public_html/home.php` and `/var/www/public_html/sitemap.php`. I think I'm going to have to pull all files that ajax requests are done on. – user784637 Mar 21 '12 at 00:58
  • I just realized your most-upvoted answer was asked by me lol – user784637 Mar 21 '12 at 01:00

0 Answers0