Block direct access to xml configuration files
I realized today that the configuration files for some ModelGlue apps I'm running are basically exposed to the public if someone can get the path and filename. The reason is that I'm using ColdFusion for server-side processing, authentication and authorization, but that only protects files that end in .cfm. Since my configuration files typically end in .xml, they can be directly accessed on the web.
Since I'm running Apache, the fix was quite simple. Place the following code into a .htaccess file at the root of your application (or higher if possible). Subfolders will automatically look up the tree to find the .htaccess files.
Order allow,deny
Deny from all
Satisfy All
</Files>
Now when you try to access the xml configuration file, the web server returns a 403 - Forbidden error and doesn't display the file. Note that the ColdFusion apps can still read them since they typically access the file more directly on the file system than through the http protocol.
Couldn't you have renamed the xml files .xml.cfm? Thats what I've done in the past. Is that not secure? Just wonderin...
However, on my Linux server, I resorted to "CHMOD"ding the file to restrict public user access. Your solution seems much more elegant, especially for people who don't have CHMOD access.
1. put all the config files outside the webroot (not possible on shared hosting but recommended in other scenarios - I have almost no code under webroot when I'm on a dedicated box)
2. use .xml.cfm file extensions - tell your editor about the mapping (easy) and have Application.cfc ensure requests to non-index.cfm files are blocked / redirected. This is what Fusebox has always done.
The Apache trick is good until you publish an XML file for folks to download...
Todd: If the xml file is on the file system, it could still be directly accessed if one knows the location (as is common for open-source apps!).
Sean: Yes, #1 would certainly work and probably be the safest long term.
My goal for this was to not change to the application at all to make the xml files secure from those who may try to access them directly.