Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I need /var/www/config/config.json to be read by my app but not by users calling myapp.com/config/config.json. How would I do that?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

There are two main methods. One is to run your app as a different user from your web server, change the permissions on files so that they can only be read by the user running the app, and then proxy to it using your web server. You can use nginx as a proxy, for example:

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass        http://localhost:1234;
        proxy_set_header  X-Real-IP  $remote_addr;
    }
}

If that's no good for you you could instead set up a rule like so to have your web server block them directly:

location ~ /config\.json$ {
    deny all;
}

This can also be done with Apache using something like this in your .htaccess:

<Files ~ "config\.json$">
    Order allow,deny
    Deny from all
</Files>
share|improve this answer
    
Can I do this from the .htaccess? because I dont have root access to the box –  James Vince Feb 2 '13 at 14:42
1  
@JamesVince See the latter part of my answer. –  Chris Down Feb 2 '13 at 14:43
    
oops sorry not with it today I think that may do the trick. –  James Vince Feb 2 '13 at 14:52

If you use SELinux, you can set the context to stop httpd and its subprocesses from accessing the file. I accidentally do that to myself all the time.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.