- Authentication
- Client Authentication
- Apache Authentication Modules
- Access Control
- Combining Access Methods
- Limiting Access Based on HTTP Methods
- Summary
- Q&A
- Quiz
- Related Directives
- Further Reading
This chapter is from the book
This chapter is from the book
This chapter is from the book
Limiting Access Based on HTTP Methods
In general, you want your access control directives to apply to all types of client requests and this is the default behavior. In some cases, however, you want to apply authentication and access rules to only certain HTTP methods such as GET and HEAD.
The <Limit> container takes a list of methods and contains the directives that apply to requests containing those methods. The complete list of methods that can be used is GET, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, and UNLOCK.
Many of these methods are WebDAV methods. WebDAV is a publishing protocol that is based on and extends HTTP. It is covered in Hour 13, "Publishing Extensions."
The <LimitExcept> section provides complementary functionality, containing directives that will apply to requests not containing the listed methods.
Listing 7.8 shows an example from the default Apache configuration file. The <Limit> and <LimitExcept> sections allow read-only methods, but deny requests to any other methods that can modify the content of the file system, such as PUT.
Listing 7.8 Restricting Access Based on Rule
1: <Directory /home/*/public_html> 2: AllowOverride FileInfo AuthConfig Limit 3: Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec 4: <Limit GET POST OPTIONS PROPFIND> 5: Order allow,deny 6: Allow from all 7: </Limit> 8: <LimitExcept GET POST OPTIONS PROPFIND> 9: Order deny,allow 10: Deny from all 11: </LimitExcept> 12: </Directory>