Re: htaccess limits
Paul <[email protected]> Fri, 8 May 2026 02:12:31 -0400
| Newsgroups | gmane.comp.apache.user |
|---|---|
| Message-ID | <[email protected]> |
--Apple-Mail-E1DE7EEA-95EA-4DEC-8B70-9351655D330E Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Paul, restricting to 127.0.0.1 might actually block your legitimate users= , as the POST request comes from their browser's IP, not the server itself. = For Apache 2.4, the best practice is usually implementing CSRF tokens in you= r Perl script or using a Require expr block to check the HTTP_REFERER to ens= ure the hit is coming from your specific form URL. Envoy=C3=A9 de mon iPad > Le 7 mai 2026 =C3=A0 19:07, Stormy-SDLU <[email protected]> a =C3=A9crit := >=20 > =EF=BB=BFLooking for best practice, please. A <virtualhost> uses html web= forms that pass data to a perl/cgi script /wherever/cgi-bin on the same ser= ver -- unfortunately outside bad actors try to POST unwanted data into that s= cript directly. >=20 > What is best practice to disallow all access to the cgi-bin except for the= local web form. I have a vague memory of 127.0.0.1 being usable by apache 2= .4.x >=20 > Thanks in advance -- Paul >=20 > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] >=20 --Apple-Mail-E1DE7EEA-95EA-4DEC-8B70-9351655D330E Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D= utf-8"></head><body dir=3D"auto"><p style=3D"margin: 0px; font-stretch: norm= al; line-height: normal; font-size-adjust: none; font-kerning: auto; font-va= riant-alternates: normal; font-variant-ligatures: normal; font-variant-numer= ic: normal; font-variant-east-asian: normal; font-variant-position: normal; f= ont-feature-settings: normal; font-optical-sizing: auto; font-variation-sett= ings: normal; color: rgb(0, 0, 0);"><font face=3D"Arial"><span style=3D"font= -size: 45px;">Hi Paul, restricting to 127.0.0.1 might actually block your le= gitimate users, as the POST request comes from their browser's IP, not the s= erver itself. For Apache 2.4, the best practice is usually implementing CSRF= tokens in your Perl script or using a Require expr block to check the HTTP_= REFERER to ensure the hit is coming from your specific form URL.</span></fon= t></p><br><div dir=3D"ltr">Envoy=C3=A9 de mon iPad</div><div dir=3D"ltr"><br= ><blockquote type=3D"cite">Le 7 mai 2026 =C3=A0 19:07, Stormy-SDLU <storm= [email protected]> a =C3=A9crit :<br><br></blockquote></div><blockquote t= ype=3D"cite"><div dir=3D"ltr">=EF=BB=BF<span>Looking for best practice, plea= se. A <virtualhost> uses html web forms that pass data to a perl= /cgi script /wherever/cgi-bin on the same server -- unfortunately outside ba= d actors try to POST unwanted data into that script directly.</span><br><spa= n></span><br><span>What is best practice to disallow all access to the cgi-b= in except for the local web form. I have a vague memory of 127.0.0.1 b= eing usable by apache 2.4.x</span><br><span></span><br><span>Thanks in advan= ce -- Paul</span><br><span></span><br><span>--------------------------------= -------------------------------------</span><br><span>To unsubscribe, e-mail= : [email protected]</span><br><span>For additional commands= , e-mail: [email protected]</span><br><span></span><br></div></blo= ckquote></body></html>= --Apple-Mail-E1DE7EEA-95EA-4DEC-8B70-9351655D330E--