Enhanced Web Site Design Stanford University Continuing Studies CS 22 Mark Branom branom@alumni.stanford.edu http://web.stanford.edu/people/markb/ Course Web Site: http://web.stanford.edu/group/csp/cs22

Manipulating Web Servers Unfinished business Limiting Access By Password By Domain/IP Address To a specific file Custom Error Documents Server-side Redirects (as opposed to <meta> tag client-side redirects) IndexIgnore Prevent Hotlinking CS 22: Enhanced Web Site Design - Manipulating Web Servers

Limiting Access Sometimes webmasters wish to restrict access to their web content. One way to do this is to protect a directory/folder, and then placing the files you wish to protect into this protected directory. Not all servers allow you to restrict your content; check with your ISP first! We’ll be demonstrating using apache web servers (Unix/Linux-based servers). Microsoft IIS servers also allow restriction, but instead of a .htaccess file, it’s a web.archive file. CS 22: Enhanced Web Site Design - Manipulating Web Servers

Step 1: Create a .htpasswd database file Connect to your unix account Change directory to the directory you wish to protect Issue "htpasswd -c .htpasswd user1" Enter the password Enter the password a second time If you wish to add more users/passwords, issue "htpasswd .htpasswd user2“ Note: if you cannot connect to your unix account, and your web host doesn’t have a httpasswd generator, there are a number of online tools. Here’s an example: http://www.htaccesstools.com/htpasswd-generator/ CS 22: Enhanced Web Site Design - Manipulating Web Servers

Step 2: Create a .htaccess file Using a text editor, create a file called ".htaccess" AuthUserFile /path/to/restricted/folder/.htpasswd AuthName YourDatabaseName AuthType Basic <Limit GET> require valid-user </Limit> Note: Use “require user username” to restrict access to specific users CS 22: Enhanced Web Site Design - Manipulating Web Servers

.htaccess file The argument to AuthUserFile must be the full path of the database used to authenticate remote users. If you don't know the full path, you can use the unix pwd command to find out. The argument to AuthName must be just one word -- if you want more than one word, you must enclose them in quotes: AuthName RestrictedPages or AuthName “Mark’s Restricted Page” but not AuthName Mark’s Restricted Page Case counts - Limit must be Limit; GET must be in all uppercase; AuthName is all one word. Make sure you leave a blank line at the end. CS 22: Enhanced Web Site Design - Manipulating Web Servers

Example http://web.stanford.edu/~markb/password/ username: stanford password: university CS 22: Enhanced Web Site Design - Manipulating Web Servers

IIS To restrict access on an IIS server, in the web.archive file: <security> <authentication> <anonymousAuthentication enabled="false" /> <basicAuthentication enabled="true" /> </authentication> </security> CS 22: Enhanced Web Site Design - Manipulating Web Servers

Restricting by domain/IP address Apache 2.2 and earlier Apache 2.3 and newer order deny,allow deny from all order allow,deny allow from all allow from stanford.edu allow from 171.64 allow from 10.24.44.122 require all denied require all granted require host stanford.edu require ip 171.64 require ip 10.24.44.122 CS 22: Enhanced Web Site Design - Manipulating Web Servers

Restricting/allowing access to a specific file <Files filename.html> <Files login.php> require all granted require host stanford.edu </Files> </Files> CS 22: Enhanced Web Site Design - Manipulating Web Servers

Manipulating Web Servers on IIS On an IIS server, in the web.archive file: <authorization> <allow users="comma-separated list of users" roles="comma-separated list of roles" verbs="comma-separated list of verbs"/> <deny users="comma-separated list of users" </authorization> CS 22: Enhanced Web Site Design - Manipulating Web Servers

Custom Error Documents ErrorDocument [http status code] [url] ErrorDocument 404 http://www.company.com/404.html List of http status codes: http://en.wikipedia.org/wiki/List_of_HTTP_status_codes CS 22: Enhanced Web Site Design - Manipulating Web Servers

Custom Error Documents - IIS On an IIS server: <customErrors defaultRedirect="url" mode="Off"> <error statusCode="403" redirect="/path-to-403-error-page.html" /> <error statusCode="404" redirect="/path-to-404-error-page.html> </customErrors> CS 22: Enhanced Web Site Design - Manipulating Web Servers

Server Redirect Server redirection (better choice): Redirect 301 oldlocation http://www.newplace.com Client-side redirection (alternative choice if you can’t manipulate the server): <meta http-equiv="refresh" content="0; url=newlocation.html"> CS 22: Enhanced Web Site Design - Manipulating Web Servers

Server Redirect - IIS On an IIS server: <configuration> <location path="oldfile1.htm"> <system.webServer> <httpRedirect enabled="true" destination="http://domain.com/new1" httpResponseStatus="Permanent" /> </system.webServer> </location> <location path="oldfile2.htm"> <httpRedirect enabled="true" destination="http://domain.com/new2" httpResponseStatus="Permanent" /> </configuration> CS 22: Enhanced Web Site Design - Manipulating Web Servers

IndexIgnore IndexIgnore The IndexIgnore directive controls which files the web server will display in the directory in which the .htaccess file is placed. For example, to hide from view all picture files in the listing of files of a directory, enter the following directive (note that this does NOT prevent visitors from displaying the file if they know it exists; it merely causes the files to not be displayed in the list of files in the directory). IndexIgnore *.gif *.jpg *.png CS 22: Enhanced Web Site Design - Manipulating Web Servers

Prevent Hotlinking Hotlinking is the process of embedding images or other media (sound, video, etc.) from one web site into another. Every time a visitor goes to a web site with an image on it, the web server that hosts that image is “hit” with the bandwidth needed to send and display that image. The web server that hosts the web page should be the same web server that hosts the image. You can prevent other webmasters from being able to “hotlink” your images by adding a few lines of code to your .htaccess file. In this example, the picture located at http://web.stanford.edu/~markb/stop.gif will display on any web site that tries to hotlink any GIF or JPG files on this site that is not coming from the Stanford servers: RewriteEngine On RewriteCond %{HTTP_REFERER} !^http://(.+\.)?stanford\.edu/ [NC] RewriteCond %{HTTP_REFERER} !^$ RewriteRule .*\.(jpe?g|gif|bmp|png)$ /~markb/stop.gif [L] CS 22: Enhanced Web Site Design - Manipulating Web Servers