----- Original Message -----
From: "Joshua Slive" <[EMAIL PROTECTED]>
To: <users@httpd.apache.org>; "Danie Qian" <[EMAIL PROTECTED]>
Sent: Friday, April 25, 2008 8:10 PM
Subject: Re: [EMAIL PROTECTED] .htaccess for script aliased directories
On Fri, Apr 25, 2008 at 4:32 PM, Danie Qian <[EMAIL PROTECTED]>
wrote:
On second thought, I tested the setting by commentting out the 'require
valid-user' line completely to see what the browsor gets for other
methods,
it is actually a 403 forbidden error instead of a open 200. So i guess I
was fine with the <limit>GET POST</limit> lines - it only triggers a
login
prompt for GET & POST while leaving the others forbidden. Am I wrong?
You may or may not create an immediate security problem by using
<Limit>. But regardless, it is a bad idea. It could easily open a
security hole in the future if you ever change the configuration of
the content behind the restriction. And why use a complex config, when
the simple one is better and more secure?
I completely agree with you in a general sense
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: [EMAIL PROTECTED]
" from the digest: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
