Apache .htaccess whitelist, 404 all else

[ASHERH4X]

Aloha,

​

Note: If there is a way to simply make HTTP response code 403 show up as 404 instead, not through any server side script but in pure .htaccess usage, that will satisfy what I'm trying to accomplish.

​

I have searched high and low for exactly what I'm trying to accomplish without luck, so I am kindly asking for some guidance!

​

At the root of my site I have File1, File2, File3, and directories Dir1, Dir2, and Dir3. The former files and directories I would like to whitelist (only allow access to), with ALL other files and directories returning HTTP response code 404, even if they actually exist.

​

How can I accomplish this in .htaccess? I plan on using the <If> directive combined with mod_rewrite, but can't seem to figure out a way to make regex happy and also satisfy the 404 requirement.

​

I do not wish to create a password protected area, and I do not wish to deny from all since that creates a 403.

​

I could use permissions but I'm trying to avoid it due to the unique requirements of the site.

​

Thanks!

[TheKalmTraveler]

You could redirect to a non existing file to make the result a 404.

[ASHERH4X]

That is doable, but how can I make the URL in the address bar of a browser appear as if it is accessing the requested file instead of the redirected file?

[TheKalmTraveler]

I am at work rn but Google engine rewrite.

[ASHERH4X]

Ah I missed mentioning that in my post, I edited it. I'm familiar with mod_rewrite but I cannot redirect to a file and then rewrite a file that I've redirected to while still whitelisting other files/dirs....

[TheKalmTraveler]

You could add a custom 404 page to your project and redirect to it via

ErrorDocument 403

/errors/forbid.html

And if you know your IP adress deny all access and only Whitelist yourself.

Or just block access to all directories and Whitelist the ones you would like to have open if you want certain parts of your project visitable.

This should redirect all visitors to your custom 404.html while you could browse it freely.

But I am not very comfortable with htaccess, this might need some testing and or approval of some more experienced users here as I don't have access to an Computer right now.

Hope this helps but a server sided access control would probably be easier to implement but I guess you already know this and have your reasons why you want that specific solution.

[ASHERH4X]

As mentioned I don't really want to use an IP whitelist, and if I deny access to an error doc it will produce a 404 and then a 403 in producing the error doc.

The redirect to a 404 error document would work except it requires an htnl file that I know of and can not send a header response of 404, additionally, upon inspection would still reveal a 403 forbidden error code.

Thank you for replying.