I realized today that the configuration files for some ModelGlue apps I'm running are basically exposed to the public if someone can get the path and filename. The reason is that I'm using ColdFusion for server-side processing, authentication and authorization, but that only protects files that end in .cfm. Since my configuration files typically end in .xml, they can be directly accessed on the web.

Since I'm running Apache, the fix was quite simple. Place the following code into a .htaccess file at the root of your application (or higher if possible). Subfolders will automatically look up the tree to find the .htaccess files.

Now when you try to access the xml configuration file, the web server returns a 403 - Forbidden error and doesn't display the file. Note that the ColdFusion apps can still read them since they typically access the file more directly on the file system than through the http protocol.