By jax on

In the .htaccess file you find the following snippet:

<FilesMatch "(\.(engine|...)$">
  Order deny,allow
  Deny from all
</FilesMatch>

Which means, default is Allow except requests that match one of the Deny rules. I was always told that the default should be Deny and only Allow from those that need access. So technically the following does the same but it is 'more correct':

<FilesMatch "(\.(engine|...)$">
  Order allow,deny
</FilesMatch>

So actually I don't understand why the first approach was chosen. In firewalls and other security related stuff the right approach always is "Deny from all and allow what is allowed", not "Allow from all and deny what is not allowed".

Comments

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented

The snippet works the opposite way from what you describe. Here's an example from the mod_access documentation:

Example:

    SetEnvIf User-Agent ^KnockKnock/2\.0 let_me_in
    <Directory /docroot>
        Order Deny,Allow
        Deny from all
        Allow from env=let_me_in
    </Directory>

In this case, browsers with a user-agent string beginning with KnockKnock/2.0 will be allowed access, and all others will be denied.

In other words, we're already doing "Deny from all and allow what is allowed." We're just not allowing any access to those files matched by the regular expression.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented

Uh. I don't know why it's done that way. Because no one ever rolled a patch to do it the other way? ;)

morbus iff’s picture

morbus iff
they/them
commented

You're on crack. Keep reading:

The presence of an Order directive can affect access to a part of the server even in the absence of accompanying Allow and Deny directives because of its effect on the default access state. For example,

[Directory /www]
Order Allow,Deny
[/Directory]

will deny all access to the /www directory because the default access state will be set to deny.

Jaza: I'd +1 a patch.

http://www.disobey.com/
http://www.gamegrene.com/
Developer of Drupal's GameAPI

http://www.disobey.com/

jax’s picture

jax commented

here http://drupal.org/node/93865