What A .htaccess File Is And How To Make One
Monday, November 06, 2006
A .htaccess file is a simple ASCII file similar to that created
through text editor such as Notepad or Simple Text. Most people
are confused with the naming convention for the file. The term
.htaccess is not a file .htaccess or somepage.htaccess because
it is the file extension simply named as such. Its widely known
use is related to implementing custom error page or password
protected directories.
Creating the File
The creation of the file is done by opening up a text editor
and saving an empty page as .htaccess. If it is not allowed to
save an empty page, simply type in one character. An editor
probably appends its default file extension to the name.
Notepad for one would call the file .htaccess.txt but the .txt
or other file extension need to be removed to enable the user
to start "htaccessing". This can be done by clicking the file
and renaming it by removing anything that doesn't say
.htaccess. It can also be renamed via telnet or the ftp
program.
These files must not be uploaded as binary but rather as ASCII
mode. Users can CHMOP the .htaccess file to 644 to make the
file usable by the server while preventing it from being read
by a browser since this can seriously compromise security. When
there are passwords protected directories and a browser can read
the .htaccess file, the location of the authentication file can
be acquired to reverse engineer the list and thereby completely
access any portion that had previously been protected. This can
be prevented by either placing all authentication files above
root directory thereby rendering the www inaccessible or
through an .htaccess series of commands that prevents itself
from being accessed by a browser.
Most commands in .htaccess are meant to be placed on one line
only thus if a text editor uses word wrap, it should be
disabled as it is possible that it might throw in a few
characters that might contradict Apache. .htaccess is not for
NT servers and is considered an Apache thing. Apache is
generally very tolerant of malformed content in an .htaccess
file.
The directory in which .htaccess file is placed is "affected"
as well as all sub-directories. It a user wishes not to have
certain .htaccess commands affect a specific directory, this is
done by placing a new .htaccess file within the directory that
should not be affected with certain changes and removing the
specific command/s. from the new .htaccess file which should
not affect the directory. The nearest .htaccess file to the
current directory is the one considered as the .htaccess file.
A global .htaccess located in the root, if considered the
nearest, affects every single directory in the entire site.
Placement of .htaccess should not be done indiscriminately as
this may result to redundancy and may cause an infinite loop of
redirects or errors. There are sites that do not allow the use
of .htaccess files because a server overloaded with domains can
be slowed down when all are using .htaccess files. It is
possible that .htaccess can compromise a server configuration
specifically set-up by the administrator. It is therefore
necessary to make sure that the use of .htaccess is allowed
before its actual use.
Error documents are only a part of the general use of
.htaccess. Specifying one's own customized error documents will
require a command within the .htaccess file. The pages can be
named anything and can be placed anywhere within the site as
long as they are web-accessible through a URL. The best names
are those that would prevent the user from forgetting what the
page is being used for.
Password protection is effectively dealt with by .htaccess. By
creating a file called .htpasswd, username and the encrypted
password of the people to be allowed access are placed in the
.htpasswd file. The .htpasswd file should likewise be not
uploaded to a directory that is web accessible for maximum
security.
Whole directories of a site can be redirected using the
.htaccess file without the need to specify each file. Thus any
request made for an old site will be redirected to the new
site, with the extra information in the URL added on. This is a
very powerful feature when used correctly.
Aside from custom error pages, password protecting folders and
automatic redirection of users, .htaccess is also capable of
changing file extension, banning users with extra certain IP
address allowing only users with certain IP addresses, stopping
directory listing and using a different file as the index file.
Accessing a site that has been protected by .htaccess will
require a browser to pop-up a standard username/password
display box. However, there are certain scripts available which
will allow the user to embed a username/password box in a
website to do the authentication. The wide variety of uses of
.htaccess facilitates time saving options and increased
security in a website.
Many hosts support .htaccess but do not publicize it while many
others have the capability for it but do not allow their users
to have an .htaccess file. Generally, a server that runs UNIX
or any version of the Apache web server will support .htaccess
although the host may not allow its use.
When to Use .htaccess Files
The .htaccess files should not be used when there is no access
to the main server configuration file. Contrary to common
belief, user authentication is not always done in .htaccess
files. The preferred way is to put user authentication
configuration in the main server configuration.
It should be used in situations where the content provider
needs to make configuration changes to the server on a
per-directory basis but does not have root access on the server
system. Individual users can be permitted to make these changes
in .htaccess files for themselves if the server administrator
is unwilling to make frequent configuration. As a general rule,
the use of .htaccess should be avoided when possible since
configuration can be effectively made in a Directory Section in
the main server configuration file.
Two main factors warrant avoiding the use of .htaccess files -
performance and security. Permitting .htaccess files causes a
performance hit whether or not it is actually used, since
Apache will look in every directory for such file. The
.htaccess file is also looked into every time a document is
requested. The Apache search will include .htaccess files in
all higher-level directories to have a full complement of
directories of application. As such, each file accessed out of
the directory results to 4 additional file system accesses even
if none was originally present.
The use of .htaccess permits users to modify server
configuration which may produce uncontrolled changes. This
privilege should be carefully considered before it is given to
users. The use of the .htaccess files can be completely
disabled by setting the Allow Overide directive to none.
About The Author: http://www.theinternetone.net
posted by Dennis Cheesman @ 5:24 AM,
