Wiki

Security:htaccess

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

How to enable mod_rewrite in .htaccess file

Opsi mod_rewrite memungkinkan Anda untuk menggunakan pengalihan dan menyembunyikan URL Anda yang sebenarnya dengan mengarahkan ke beberapa URL lain. Opsi ini terbukti sangat berguna sehingga Anda dapat mengganti URL yang panjang dan panjang menjadi yang pendek dan mudah diingat.

Untuk mengizinkan mod_rewrite, praktikkan saja untuk menambahkan baris berikut sebagai baris pertama file .htaccess Anda. 

Options +FollowSymLinks

Opsi ini memungkinkan Anda untuk mengikuti tautan simbolik dan dengan demikian mengaktifkan opsi mod_rewrite di situs web. Mengganti URL dengan yang pendek dan renyah disajikan nanti.

How to Allow or Deny Access to Websites

File htaccess dapat mengizinkan atau menolak akses situs web atau folder atau file di direktori tempat ia ditempatkan dengan menggunakan kata kunci perintah, allow, dan deny.

Mengizinkan akses hanya ke 192.168.3.1 IP

Order Allow, Deny
Deny from All
Allow from 192.168.3.1

Atau 

Order Allow, Deny
Allow from 192.168.3.1

Kata kunci pesanan di sini menentukan urutan pemrosesan izinkan, tolak akses. Untuk pernyataan 'Pesan' di atas, pernyataan Izinkan akan diproses terlebih dahulu dan kemudian pernyataan penolakan akan diproses.

Denying access to only one IP Address

Baris di bawah ini menyediakan sarana untuk memungkinkan akses situs web ke semua pengguna yang menerima satu dengan Alamat IP: 192.168.3.1. 

Order Allow, Deny
Deny from 192.168.3.1
Allow from All

Atau 

Order Deny, Allow
Deny from 192.168.3.1

Generate Apache Error documents for different error codes

Menggunakan beberapa baris sederhana, kita dapat memperbaiki dokumen kesalahan yang berjalan pada kode kesalahan berbeda yang dihasilkan oleh server ketika pengguna/klien meminta halaman yang tidak tersedia di situs web seperti kebanyakan dari kita akan melihat halaman '404 Halaman tidak ditemukan' di halaman mereka peramban web. File .htaccess menentukan tindakan apa yang harus diambil jika terjadi kondisi kesalahan seperti itu.

Untuk melakukan ini, baris berikut perlu ditambahkan ke file .htaccess: 

ErrorDocument <error-code> <path-of-document/string-representing-html-file-content>

ErrorDocument adalah kata kunci, kode kesalahan dapat berupa 401, 403, 404, 500 atau kesalahan valid yang mewakili kode dan terakhir, path-of-document mewakili jalur pada mesin lokal (jika Anda menggunakan server lokal Anda sendiri) atau di server (jika Anda menggunakan server lain untuk meng-host situs web Anda).

Example: 

ErrorDocument 404 /error-docs/error-404.html

Baris di atas mengatur dokumen error-404.html yang ditempatkan di folder error-docs untuk ditampilkan jika kesalahan 404 dilaporkan oleh server untuk permintaan halaman yang tidak valid oleh klien. 

errorDocument 404 "<html><head><title>404 Page not found</title></head><body><p>The page you request is not present. Check the URL you have typed</p></body></html>"

Setting/Unsetting Apache server environment variables

Dalam file .htaccess Anda dapat mengatur atau menghapus variabel global yang diizinkan server untuk dimodifikasi oleh hoster situs web. Untuk mengatur atau menghapus variabel, Anda perlu menambahkan baris berikut ke file .htaccess Anda.

Setting the Environment variables

SetEnv OWNER “Gunjit Khera”

Unsetting the Environment variables

UnsetEnv OWNER

Defining different MIME types for files

MIME (Multipurpose Internet Multimedia Extensions) are the types that are recognized by the browser by default when running any web page. You can define MIME types for your website in .htaccess files, so that different types of files as defined by you can be recognized and run by the server. 

<IfModule mod_mime.c>
    AddType	application/javascript		js
    AddType application/x-font-ttf		ttf ttc
</IfModule>

Here, mod_mime.c is the module for controlling definitions of different MIME types and if you have this module installed on your system then you can use this module to define different MIME types for different extensions used in your website so that server can understand them.

How to Limit the size of Uploads and Downloads in Apache

.htaccess files allow you the feature to control the amount of data being uploaded or downloaded by a particular client from your website. For this you just need to append the following lines to your .htaccess file: 

php_value upload_max_filesize 20M
php_value post_max_size 20M
php_value max_execution_time 200
php_value max_input_time 200

The above lines set maximum upload size, maximum size of data being posted, maximum execution time i.e. the maximum time the a user is allowed to execute a website on his local machine, maximum time constrain within on the input time. 


# +-------------------------------------------------------------------------+
# DISABLE UNAUTHORIZED DIRECTORY BROWSING
# +-------------------------------------------------------------------------+

# Prevent a Directory Listing of Your Website with .htaccess
# Block a Directory Index from Being Shown

Options -Indexes

# +-------------------------------------------------------------------------+
# DISABLE THE SERVER SIGNATURE
# +-------------------------------------------------------------------------+

# For a server running Apache web server in a production environment,
# it is advisable to disable Server Signatures. These signatures displayed
# on error pages, and in other communications with the web server,
# may reveal sensitive information about the software versions running on the web server.

ServerSignature Off

# +-------------------------------------------------------------------------+
# SET YOUR DEVELOPMENT ENVIRONMENT
# +-------------------------------------------------------------------------+

# SetEnv, used in Apache's configuration (be it a .htaccess file,
# or a VirtualHost), defines an environment variable.

SetEnv APPLICATION_ENV production

# +-------------------------------------------------------------------------+
# DISABLE ETAGS:
# +-------------------------------------------------------------------------+

# First off let’s try to understand what ETAGs actually are. If you have ETAGs turned on for
# your site then each asset sent from your server to a client is sent with an ETAG in
# it’s header. For Apache this key is constructed from the files inode, size and last modified datetime.
# So what does the client actually do with an ETAG for a particular asset?
# If the client has the asset cached then the expire header of the asset is checked first to see
# if the server needs to be contacted at all. If the asset has not expired then the ETAG has no effect at all,
# the locally cached version will be used. If the asset has indeed expired then the client will send a request
# for the asset with the ETAG stored by the client to the server. The server performs a comparison between
# the ETAG of the asset and the ETAG sent by the client, if the ETAGs match then the server will
# return a 304 not modified header which instructs the browser to use it’s cached version of the asset.
# If they do not match the server will return the asset.
# As you might have deduced, if any of the properties that make up an ETAG for the assets web server change then a different
# ETAG will be generated which will force the users browser to re cache the file, this will only
# happen however if the clients cached version of the asset has expired though as noted above.
# So ETAGs will not magically force clients to re cache assets when you make changes to them.
#
# When ETAGs go bad
#
# So far ETAGs certainly sound like a useful tool for assets caching.
# Things aren’t so simple however due to an issue that arises when ETAGs are used in load balanced environments.
# As noted above for Apache (and for other web servers as well) an assets location on disk
# is taken into account when generating an ETAG, this includes information about the actual server that the file is located on.
# This means that in a load balanced environment each server will generate a different ETAG for the same file,
# making ETAGs pretty useless in such circumstances. This is the issue that causes a lot of people to
# disable ETAGs completely and opt for using cache control headers only for their assets.
#
# There is a suggested solution for this, and that involves removing the inode part from ETAGs entirely
# so they will be based on a files size and last modified time .
#
# But, to increase page loading speed, my advice is YSlow.
# perfect tool & Yslow recommends to use ETAGs instead of setting off.

Header unset Pragma
FileETAG None
Header unset ETAG
FileETag MTime Size

<ifmodule mod_expires.c>
  <filesmatch "\.(jpg|gif|png|css|js)$">
       ExpiresActive on
       ExpiresDefault "access plus 1 year"
   </filesmatch>
</ifmodule>

# +-------------------------------------------------------------------------+
# SET THE DEFAULT LANGUAGE
# +-------------------------------------------------------------------------+

# DefaultLanguage is intended for set the default language when a directory contains multiple language files,
# e.g.: index.html.en, index.html.fr. They need to be set with AddLanguage in Apache configuration somewhere:
#
# AddLanguage en .en
# AddLanguage fr .fr
#
# Files will these extensions will be delivered with the Content-Language HTTP header.
# If no extension is provided, can be a coincidence to have both methods generating the
# Content-Language header but if you want to explicitly set the document Content-Language may
# run slightly faster with explicit header definition, as it does not need to check the
# file extension and fallback to a default language if set.

DefaultLanguage en-US

# +-------------------------------------------------------------------------+
# SET THE DEFAULT CHARACTER SET
# +-------------------------------------------------------------------------+

# Setting charset information in .htaccess
# it is important to ensure that any information about character encoding sent by the server
# is correct, since information in the HTTP header overrides information in the document itself.
# AddCharset UTF-8 .html
# Many Apache servers are configured to send files using the ISO-8859-1 (Latin-1) encoding

AddDefaultCharset UTF-8

# +-------------------------------------------------------------------------+
# SET DEFAULT EXECUTED FILE
# +-------------------------------------------------------------------------+

# The directoryindex command allows you to specify a default page to display when a directory is accessed.
# For instance, if a visitor requests a directory on your web site, you can specify the
# file to load when the directory is accessed (if a filename is not specified in the initial request).
# For example, to display a 'index.html' file rather than showing directory listings or to
# load a 'index.php' file rather than an 'index.html' file.
#
# To set-up a directoryindex, create a .htaccess file following the main instructions
# and guidance which includes the following text:

DirectoryIndex index.php index.html

# +-------------------------------------------------------------------------+
# SET MODE RE-WRITE
# +-------------------------------------------------------------------------+

# The Apache module mod_rewrite allows you to rewrite URL requests that come into
# your server and is based on a regular-expression parser

RewriteEngine On

# +-------------------------------------------------------------------------+
# REDIRECT HTTP TRAFFIC TO HTTPS
# +-------------------------------------------------------------------------+

# if server has https vars

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}%{REQUEST_URI} [R,L]

# if server dont have https vars, in case load balancing servers or proxy servers
# and you are getting redirect loop by above code

RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [R=302,L]

# +-------------------------------------------------------------------------+
# ENSURE - WWW IN URL
# +-------------------------------------------------------------------------+

# re direct url on www if not exist

RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# +-------------------------------------------------------------------------+
# REMOVE ALL QUERY STRING FROM URLS
# +-------------------------------------------------------------------------+

# remove all url query string fro url and clean them

RewriteCond %{QUERY_STRING} .
RewriteRule ^$ /? [R,L]

# +-------------------------------------------------------------------------+
# GET ALL REQUEST ON INDEX FILE
# +-------------------------------------------------------------------------+

# get all request on index file only

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule .* index.php/$0 [PT,L]

# +-------------------------------------------------------------------------+
# REWRITECOND: BAD FLAG DELIMITERS
# +-------------------------------------------------------------------------+

# block out any script that includes a <script> tag in url.
RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]

# block out use of illegal or unsafe characters in the http request
RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|%0A|%0D).* [NC,OR]

# block out use of illegal or unsafe characters in the referer variable of the http request
RewriteCond %{HTTP_REFERER} ^(.*)(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]

# block out use of illegal or unsafe characters in any cookie associated with the http request
RewriteCond %{HTTP_COOKIE} ^.*(<|>|'|%0A|%0D|%27|%3C|%3E|%00).* [NC,OR]

# block out use of illegal characters in uri or use of malformed uri
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|">|"<|/|\\\.\.\\).{0,9999}.* [NC,OR]

# block out  use of illegal or unsafe characters in the query string variable
RewriteCond %{QUERY_STRING} ^.*(<|>|'|"|%0A|%0D|%27|%3C|%3E|%00|%20).* [NC]

# return 403 forbidden header and show the content of the root homepage
RewriteRule .* index.php [F]

# +-------------------------------------------------------------------------+
# PHP ENVIRONMENT SETUP
# +-------------------------------------------------------------------------+

# PHP Server Setup and Application Settings

# PHP Flags
php_flag display_startup_errors on
php_flag display_errors on
php_flag html_errors on
php_flag log_errors on
php_flag ignore_repeated_errors on
php_flag ignore_repeated_source on
php_flag report_memleaks on
php_flag track_errors on

# PHP Values
php_value docref_root 0
php_value docref_ext 0
php_value error_log %{DOCUMENT_ROOT}/logs/full_stack_error.log
php_value error_reporting -1
php_value log_errors_max_len 0

# +-------------------------------------------------------------------------+
# FORM POST AND UPLOAD SETTINGS
# +-------------------------------------------------------------------------+
php_value upload_max_filesize 128M
php_value post_max_size 128M
php_value max_input_time 3600
php_value max_execution_time 3600

# +-------------------------------------------------------------------------+
# SESSION COOKIES HTTP & SECURE FLAG
# +-------------------------------------------------------------------------+
php_value session.cookie_httponly on
php_value session.cookie_secure on

# +-------------------------------------------------------------------------+
# DELETE FILE EXTENSIONS
# +-------------------------------------------------------------------------+
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule ^([^\.]+)$ $1.php [NC,L]

# +-------------------------------------------------------------------------+
# ONLY ALLOW GET & POST REQUEST
# +-------------------------------------------------------------------------+
<LimitExcept GET POST>
Order Allow,Deny
Deny from all
</LimitExcept>

# +-------------------------------------------------------------------------+
# BLOCK ACCESS TO LOG FILE
# +-------------------------------------------------------------------------+
<files site_error.php>
Order allow,deny
Deny from all
</files>

# +-------------------------------------------------------------------------+
# BLOCK ACCESS TO MULTIPLE FILE TYPES
# +-------------------------------------------------------------------------+
<FilesMatch "\.(sql|bat|htaccess|htpasswd|ini|psd|log|sh|error|error|error|info|php_info|info_php|bkp|backup|src|exe|dll|src|msi|\.[hH][tT])$">
Order allow,deny
Deny from all
</FilesMatch>

# +-------------------------------------------------------------------------+
# DENY ACCESS TO ONE SPECIFIC FOLDER
# +-------------------------------------------------------------------------+
Deny from all

# +-------------------------------------------------------------------------+
# EXPIREATION SETTINGS
# +-------------------------------------------------------------------------+
<FilesMatch "\.(?i:gif|jpe?g|png|ico|css|js|swf|css|js|ico|pdf|jpg|jpeg|png|gif|html|htm|xml|txt|xsl|svg|ttf|otf)$">
  <IfModule mod_headers.c>
    Header set Cache-Control "max-age=2592000, public"
  </IfModule>
</FilesMatch>

# +-------------------------------------------------------------------------+
# LEVERAGE BROWSER CACHING
# +-------------------------------------------------------------------------+
<IfModule mod_expires.c>
  ExpiresActive On
  ExpiresByType image/jpg "access 1 year"
  ExpiresByType image/jpeg "access 1 year"
  ExpiresByType image/gif "access 1 year"
  ExpiresByType image/png "access 1 year"
  ExpiresByType text/css "access 1 month"
  ExpiresByType text/html "access 1 month"
  ExpiresByType application/pdf "access 1 month"
  ExpiresByType text/x-javascript "access 1 month"
  ExpiresByType application/x-shockwave-flash "access 1 month"
  ExpiresByType image/x-icon "access 1 year"
  ExpiresDefault "access 1 month"
</IfModule>

<IfModule mod_headers.c>
  <filesmatch "\.(ico|flv|jpg|jpeg|png|gif|css|swf)$">
  Header set Cache-Control "max-age=2678400, public"
  </filesmatch>
  <filesmatch "\.(html|htm)$">
  Header set Cache-Control "max-age=7200, private, must-revalidate"
  </filesmatch>
  <filesmatch "\.(pdf)$">
  Header set Cache-Control "max-age=86400, public"
  </filesmatch>
  <filesmatch "\.(js)$">
  Header set Cache-Control "max-age=2678400, private"
  </filesmatch>
</IfModule>

<ifmodule mod_expires.c>
<Filesmatch "\.(jpg|jpeg|png|gif|js|css|swf|ico|woff|mp3)$">
    ExpiresActive on
    ExpiresDefault "access plus 2 days"
</Filesmatch>
</ifmodule>

# +-------------------------------------------------------------------------+
# HTTP Strict Transport Security (HSTS) header
# +-------------------------------------------------------------------------+

# HSTS is an acronym for HTTP Strict Transport Security
# It is a security enhancement which ensures only secure pages from your domain are shown by a browser
# Automatically redirects HTTP requests to HTTPS for the target domain
# Does not allow a user to override the invalid certificate message
# Enabled through the use of a special response header
# Can be preloaded via browsers by listing your domain

<IfModule mod_headers.c>
Header set Strict-Transport-Security "max-age=10886400; includeSubDomains; preload" env=HTTPS
<FilesMatch "\.(css|gif|ico|jpeg|jpg|js|png|woff)$">
Header unset Strict-Transport-Security
</FilesMatch>
</IfModule>

# +-------------------------------------------------------------------------+
# BLOCK IFRAME CALL
# +-------------------------------------------------------------------------+

# The X-Frame-Options HTTP response header can be used to indicate whether or not a browser
# should be allowed to render a page in a <frame> or <iframe>. This can be used to
# avoid clickjacking attacks, by ensuring that your content is not embedded into other sites

<IfModule mod_headers.c>
Header set X-Frame-Options "SAMEORIGIN"
</IfModule>

# +-------------------------------------------------------------------------+
# SECURITY HEADERS - X-CONTENT-TYPE: NOSNIFF
# +-------------------------------------------------------------------------+
<IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff"
</IfModule>

# +-------------------------------------------------------------------------+
# HTTP HEADER X-XSS-PROTECTION
# +-------------------------------------------------------------------------+
<IfModule mod_headers.c>
Header append X-XSS-Protection: "1; mode=block;"
</IfModule>

# +-------------------------------------------------------------------------+
# Avoid HTTP method
# +-------------------------------------------------------------------------+
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS)
RewriteRule ^ - [F]

Source

Retrieved from "https://kangtain.com/wiki/index.php?title=Security:htaccess&oldid=5858"