Modify .htaccess to deny access into folder, but allow access only from my site using ajax to specific files

Question

in my site "www.website.com" i have a folder with forbidden access using this .htaccess :

RewriteEngine On
RewriteBase /
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+)/.*\ HTTP [NC]
RewriteRule .* - [F,L]

Now i want to have access only from my site "www.website.com" to a specific PHP files using Ajax (POST). I have modify .htaccess like this:

RewriteEngine On
RewriteBase /
RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+)/.*\ HTTP [NC]
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http(s)?://.*website.com [NC]
RewriteRule \.(php)$ - [NC,F,L]

But with this code i have access to all php files. I need to access only in *Add.php and *Edit.php . These files are in several subfolders. What should i do ? Is this the right way to do this?

Answer 1

Well, after a lot of searching, reading and testing i conclude that the best way to secure a website that works using Ajax is:

1 - Have only one (if possible) file like router.php that will "route" depending on the POST/GET navigation variables, using includes to files that are in sub-folders.

2 - Except of SESSION-based authentication you could also implement Basic HTTP authentication and/or HTTPS (SSL) to secure user credentials when login. If you are not using HTTPs, you should use field or form encryption because in 'wire' all are in plaintext. I have found useful this http://www.itsyndicate.ca/jquery/

3 - In every POST use Token-based Authentication with a token that is created from user credentials, send over with the request and then re-calculate and compare.

4 - I have tried lot of combinations for using only one .htaccess in document ROOT but always something was missing, or miss-configured or not working as i expected. So, i found more simple to use one .htaccess in every sub-folder instead of one in the root. In sub-folders depending on what they contain's .htaccess should look like this:

### No Direct Access to All files ###
<IfModule mod_authz_host.c>
    Order Deny,Allow
    Deny from all
#   Allow from 127.0.0.1
</IfModule>

### One of the alternative ways with mod_rewrite ###
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteCond %{THE_REQUEST} ^[A-Z]{3,9}\ /([^/]+)/.*\ HTTP [NC]
    RewriteRule .* - [F,L]
</IfModule>

### permit ONLY filetypes in a pattern ###
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteCond %{REQUEST_FILENAME} ^(.+)\.(css|js|gif|png|jpe?g|woff)$
    RewriteRule .? - [S=1]
    RewriteRule ^(.+)$ - [F,L,NC]
</IfModule>

I prefer THE_REQUEST because this does not include any additional headers sent by the browser. This value has not been unescaped (decoded), unlike most other variables, and it has no point to spoof. I use skip [S=1] because i prefer to tell "If that then this rule not valid", so, in any other case the rule that "Denies" it is valid.

5 - For extra security you can use code inside php files, implementing one of the methods described in this article: Prevent direct access to a php include file

6 - Also, if you are Forbidding Image Hotlinking (and NOT only) described here , beware that referer can be spoofed!!