How different middleware restrict page access

Article directory

  • foreword
  • 1. web.xml
    • 1. What is web.xml?
    • 2. Example of web.xml restricting page access
  • 2. .htaccess
    • 1. What is .htaccess?
    • 2. Example of .htaccess restricting page access
  • 3. web.config
    • 1. What is web.config?
    • 2. Example of web.config restricting page access
  • 4. nginx.config
    • 1. What is nginx.config?
    • 2. Example of nginx.config restricting page access

Foreword

When we visit the page, there are often 403 pages. How is this implemented in the backend?

Each language implements different files for restricting access to pages, for example, web.xml, .htaccess, web.config, we simply use a few cases to illustrate

1. web.xml

1. What is web.xml?

The web.xml file applies only to Java web applications. It is part of the Java EE (Enterprise Edition) specification and is used to describe configuration and deployment information for web applications.

2.web.xml restricts page access example

You can restrict which pages can be accessed and which pages cannot be accessed through the security constraints in the web.xml file. Security constraints are a mechanism for securing web application resources that control user access to specific resources.

In the web.xml file, you can use the tag to define security constraints, and use the tag to specify the resources to be protected. Such as Servlet, JSP or static files, etc., and then use the tag to specify which roles can access protected resources.

For example, the following code snippet defines a security constraint that restricts all resources in the /admin/* directory to be accessed only by users with the admin role:

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Admin Pages</web-resource-name>
    <url-pattern>/admin/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>admin</role-name>
  </auth-constraint>
</security-constraint>

2. .htaccess

1. What is .htaccess?

The .htaccess file is a special Apache configuration file used to configure the behavior and properties of a website at the web server level. By adding some instructions in the .htaccess file, the function of restricting page access can be realized

2. Example of .htaccess restricting page access

Here’s a basic .htaccess file to restrict all pages in the /admin directory to only users with the admin role:

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

<FilesMatch "\.(php|html)$">
  AuthType Basic
  AuthName "Restricted Area"
  AuthUserFile /path/to/.htpasswd
  Require valid-user
</FilesMatch>

<Files "login.php">
  Order Allow, Deny
  Allow from all
</Files>

In the above example,
AuthType Basic specifies the authentication type as basic authentication,
AuthName specifies the authentication prompt information,
AuthUserFile specifies the file path to store user credentials,
Require valid-user specifies the user that needs to be authenticated.

Used to match specific files, such as .php or .html files, and perform corresponding authentication and access restrictions on them.

Used to specify specific files, such as login.php, and apply specific access controls to them, such as allowing access to all users.

It should be noted that in order to use .htaccess files to restrict page access, you need to ensure that the web server has enabled .htaccess file support and allows overriding the default configuration. Otherwise, the directives in the .htaccess file will have no effect.

3. web.config

1. What is web.config?

web.config is an XML-formatted configuration file commonly used in ASP.NET web applications. It provides a way to configure the behavior of the application at the web application level, and can contain some directives to control the behavior of the application in terms of access, security, caching, error handling, etc.

2. Example of web.config restricting page access

In the web.config file, you can use the element to restrict access to pages. This element can contain a series of and sub-elements to specify which users or roles have access to the page and which users or roles do not have access permissions .

For example, the following web.config file configures that only administrator roles can access the Admin.aspx page, and ordinary users and unauthorized users cannot access it:

<configuration>
  <system.web>
    <authorization>
      <allow roles="Admin"/>
      <deny users="*"/>
    </authorization>
  </system.web>
</configuration>

In the above example, it is specified that only users with the Admin role have access to the page, and it is specified that all unauthorized users cannot access the page.

In addition to using roles and users to restrict access to pages, you can also use some other conditions, such as IP address, HTTP method, HTTP header, etc. For example, the following web.config file configures the Admin.aspx page to be accessed only by requests from specific IP addresses:

<configuration>
  <system.web>
    <authorization>
      <allow ips="192.168.1.1"/>
      <deny users="*"/>
    </authorization>
  </system.web>
</configuration>

In the above example, specifies that only requests from the IP address 192.168.1.1 can access the page, specifies that all unauthorized users cannot access the page.

4. nginx.config

1. What is nginx.config?

The Nginx configuration file (nginx.conf) is the main configuration file for the Nginx web server and is used to control the behavior of the server. The Nginx configuration file uses a syntax similar to C language and consists of a series of instructions and blocks, which are used to define which ports and domain names the server listens to, how to handle HTTP requests, how to perform load balancing, etc.

Example of 2.nginx.config restricting page access

In Nginx, you can use the location directive to restrict page access. The location directive is used to match URLs, and can specify a series of conditions, such as request methods, request headers, request parameters, etc., to determine whether to allow access to the URL.

Here is an example of how to use the location directive to restrict access to pages:

server {
    listen 80;
    server_name example.com;

    location /admin {
        # Only allow requests from specific IP addresses
        allow 192.168.1.1;
        deny all;
        
        # only allow POST requests
        if ($request_method != POST) {
            return 405;
        }
        
        # Only allow specific users to access
        auth_basic "Restricted";
        auth_basic_user_file /etc/nginx/.htpasswd;
        
        # other configuration
        ...
    }
    
    # other configuration
    ...
}

In the above example, location /admin means match all URLs that start with /admin. The location block contains a series of restrictions that restrict access to the /admin page:

  • allow 192.168.1.1; deny all; Only requests from IP address 192.168.1.1 are allowed to access this page, other requests will be denied.
  • if ($request_method != POST) { return 405; } Only the POST method is allowed to access the page, and all other requests will return a 405 error.
  • auth_basic “Restricted”; auth_basic_user_file /etc/nginx/.htpasswd; It is only allowed to access the page if the authentication is passed, and a user name and password are required. Usernames and passwords are stored in the /etc/nginx/.htpasswd file.