How to add this exception to htaccess?

user_5086345 0
Viewed 74

I have this course created with software called Articulate Storyline, which from there you can export as html5. An LMS plugin on my site manages access to the course, and the html5 export is included there as an iframe. To prevent access to the html5 export from outside the LMS I added an htaccess file to the server folder with the html5 export, in line with this post.

Exported course files are in: /public_html/courses/course_a/ (there are multiple courses).
Course url: https://example.com/coursename/courseA/ (which has an iframe that points to https://example.com/courses/course_a/story.html).

I created /public_html/courses/.htaccess with:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !\example\.com/coursename/ [NC]
RewriteRule ^ - [F,L]

It all works except that if you load the course there are the following 403 errors in the console:

GET https://example.com/courses/course_a/html5/lib/stylesheets/mobile-fonts/open-sans-light.woff net::ERR_ABORTED 403 desktop.min.css:1 
GET https://example.com/courses/course_a/html5/lib/stylesheets/mobile-fonts/open-sans-regular.woff net::ERR_ABORTED 403 desktop.min.css:1 
GET https://example.com/courses/course_a/html5/lib/stylesheets/mobile-fonts/open-sans-bold.woff net::ERR_ABORTED 403 desktop.min.css:1

I think the .htaccess files I added causes this. Is there a way to create an exception in the .htaccess file for the /mobile-fonts/ folder or for woff files?

Update: I updated /public_html/courses/.htaccess to:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^https://example\.com/coursename/ [OR]
RewriteCond %{HTTP_REFERER} !^https://example\.com/courses/
RewriteRule ^ - [F,END]

However, I now get a 403 error both for https://example.com/coursename/courseA/ (403 for the iframe) and for https://example.com/courses/course_a/story.html. For the second, I indeed want a 403 but not for the first.

If I remove [OR] RewriteCond %{HTTP_REFERER} !^https://example\.com/courses/ then https://example.com/coursename/courseA/ works and does not return a 403. But then I can even change the first RewriteCond to !^https://example\.com/coursename/fhwfhf and it still loads the iframe...

.htaccess iframe security
1 Answers

As discussed in the comments to the question one approach is to add the URL of the "page" loaded into that iframe itself to your condition:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^https://example\.com/url-that-includes-the-iframe
RewriteCond %{HTTP_REFERER} !^https://example\.com/folder-that-iframe-points-to
RewriteRule ^ - [F,END]

A directly entered URL pointing to https://example\.com/folder-that-iframe-points-to should not have a referer set at all, so I would expect such request to get blocked...

Another approach would be to explicitly allow access to resources referenced by the "page" delivered into the iframe. This can be done by adding such an exception before the actual blocking rule:

RewriteEngine On
RewriteRule ^/?html5/lib/stylesheets/ - [END]
RewriteCond %{HTTP_REFERER} !^https://example\.com/url-that-includes-the-iframe
RewriteRule ^ - [F,END]

Or, alternatively, the same can also be achieved by adding that exception to the condition of the actual blocking rule. Note that this variant does not specify an [OR] operand, the default logical "and" operator is what needs to get applied:

RewriteEngine On
RewriteCond %{HTTP_REFERER} !^https://example\.com/url-that-includes-the-iframe
RewriteCond %{REQUEST_URI} !^/html5/lib/stylesheets/
RewriteRule ^ - [F,END]

For all of these approaches the rewriting module needs to be loaded and activated into the http server. The rules are best placed into the actual host configuration inside the http server. Without access to that a distributed configuration file can be used (".htaccess"), but that comes with some disadvantages and requires the interpretation of such files to be enabled (see the documentaton for that...).

user_12481140
Related