拒绝访问文件夹内的文件，但允许 REST API

Question

I am using this .htaccess to simulate a folder full of files (a simple REST API):

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule files/(.*)$ api.php?file=$1 [QSA,NC,L]

Let's call this folder magicfolder where I am using this .htaccess file. In fact, there is only api.php that is creating every file that is requested. So, an url like mysite.com/magicfolder/files/image.jpg is converted into mysite.com/magicfolder/api.php?file=image.jpg . This is great. But I want also to add some rules that makes any real file that exists in magicfolder (logs and even api.php ) to be inaccessible for users.

Answer 1

With your shown samples, could you please try following. Please clear your browser cache before testing your URLs. Make sure your htaccess rules file is present inside magicfolder folder.

RewriteEngine On
RewriteCond %{ENV:REDIRECT_STATUS} ^$
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^ - [F,L]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^files/(.*)/?$ api.php?file=$1 [QSA,NC,L]