Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need /var/www/config/config.json to be read by my app but not by users calling myapp.com/config/config.json. How would I do that?

share|improve this question
up vote 3 down vote accepted

There are two main methods. One is to run your app as a different user from your web server, change the permissions on files so that they can only be read by the user running the app, and then proxy to it using your web server. You can use nginx as a proxy, for example:

server {
    listen 80;
    server_name example.com;

    location / {
        proxy_pass        http://localhost:1234;
        proxy_set_header  X-Real-IP  $remote_addr;

If that's no good for you you could instead set up a rule like so to have your web server block them directly:

location ~ /config\.json$ {
    deny all;

This can also be done with Apache using something like this in your .htaccess:

<Files ~ "config\.json$">
    Order allow,deny
    Deny from all
share|improve this answer
Can I do this from the .htaccess? because I dont have root access to the box – James Vince Feb 2 '13 at 14:42
@JamesVince See the latter part of my answer. – Chris Down Feb 2 '13 at 14:43
oops sorry not with it today I think that may do the trick. – James Vince Feb 2 '13 at 14:52

If you use SELinux, you can set the context to stop httpd and its subprocesses from accessing the file. I accidentally do that to myself all the time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.