JavaScript Editor Javascript source editor     Web programming 

Team LiB
Previous Section Next Section

Limiting Access Based on HTTP Methods

In general, you want your access control directives to apply to all types of client requests, and this is the default behavior. In some cases, however, you want to apply authentication and access rules to only certain HTTP methods such as GET and HEAD.

The <Limit> container takes a list of methods and contains the directives that apply to requests containing those methods. The complete list of methods that can be used is GET, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, and UNLOCK.

The <LimitExcept> section provides complementary functionality, containing directives that will apply to requests not containing the listed methods.

Listing 24.5 shows an example from the default Apache configuration file. The <Limit> and <LimitExcept> sections allow read-only methods but deny requests to any other methods that can modify the content of the file system, such as PUT. For more information on the myriad options available here, see the Apache documentation at

Listing 24.5. Restricting Access Based on Rule
 1:  <Directory /home/*/public_html>
 2:    AllowOverride FileInfo AuthConfig Limit
 3:    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
 5:      Order Allow,Deny
 6:      Allow from all
 7:    </Limit>
 9:      Order Deny,Allow
10:      Deny from all
11:    </LimitExcept>
12:  </Directory>

In the next section, you'll learn about restricting access on the application side based on information found in cookies.

    Team LiB
    Previous Section Next Section

    JavaScript Editor Javascript source editor     Web programming