# Block access to every file in the site but index.htm

**URL:** <https://www.ruby-forum.com/t/block-access-to-every-file-in-the-site-but-index-htm/203342>\
**Category:** NGINX\
**Created:** [February 18, 2011, 3:02am UTC](https://www.ruby-forum.com/t/block-access-to-every-file-in-the-site-but-index-htm/203342 "2011-02-18T03:02:08Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [February 18, 2011, 3:02am UTC](https://www.ruby-forum.com/t/block-access-to-every-file-in-the-site-but-index-htm/203342/1 "2011-02-18T03:02:08Z")

</div>

I have a site with just one file: index.htm witch have some ajax linked  
to php files. I’d like to make thouse php files only accessable via ajax  
(post and get) coming from this index file and block access to all files  
but the index.htm. Is it possible in Nginx? Thanks.

Posted at Nginx Forum:

> **[Block access to every file in the site but index.htm](https://forum.nginx.org/read.php?2,176352,176352#msg-176352)**
>
> I have a site with just one file: index.htm witch have some ajax linked to php files. I'd like to make thouse php files only accessable via ajax (post and get) coming from this index file and block access to all files but the index.htm. Is it...

---

<div class="post-metadata">

**Author:** ![atipico](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@atipico](https://www.ruby-forum.com/u/atipico)\
**Post date:** [February 18, 2011, 4:01am UTC](https://www.ruby-forum.com/t/block-access-to-every-file-in-the-site-but-index-htm/203342/2 "2011-02-18T04:01:31Z")

</div>

On Fri, Feb 18, 2011 at 9:00 AM, atipico [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I have a site with just one file: index.htm witch have some ajax linked  
> to php files. I’d like to make thouse php files only accessable via ajax  
> (post and get) coming from this index file and block access to all files  
> but the index.htm. Is it possible in Nginx? Thanks.

location = /index.htm {  
root …  
…  
}

location / { return 404; }

---

<div class="post-metadata">

**Author:** ![atipico](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@atipico](https://www.ruby-forum.com/u/atipico)\
**Post date:** [February 18, 2011, 9:02am UTC](https://www.ruby-forum.com/t/block-access-to-every-file-in-the-site-but-index-htm/203342/3 "2011-02-18T09:02:03Z")

</div>

On 02/18/2011 10:59 AM, Edho P Arief wrote:

> location / { return 404; }
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)  
> using ajax cannot get correct response either.  
> you can protect information by COOKIE:

location = /index.htm {  
root …  
add\_header Set-Cookie allow=true;  
}  
location / {  
if ($COOKIE\_allow = true ) {…}  
return 404;  
}

---

<div class="post-metadata">

**Author:** ![atipico](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@atipico](https://www.ruby-forum.com/u/atipico)\
**Post date:** [February 18, 2011, 11:11am UTC](https://www.ruby-forum.com/t/block-access-to-every-file-in-the-site-but-index-htm/203342/4 "2011-02-18T11:11:15Z")

</div>

Please, Tony, just to clarify: when you say “protect information by  
COOKIE”, are talking about this?  
[http://nginx.org/pipermail/nginx/2009-June/012857.html](http://nginx.org/pipermail/nginx/2009-June/012857.html)  
Thanks!

Posted at Nginx Forum:

> **[Re: Block access to every file in the site but index.htm](https://forum.nginx.org/read.php?2,176352,176415#msg-176415)**
>
> I have a site with just one file: index.htm witch have some ajax linked to php files. I'd like to make thouse php files only accessable via ajax (post and get) coming from this index file and block access to all files but the index.htm. Is it...

---

<div class="post-metadata">

**Author:** ![atipico](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@atipico](https://www.ruby-forum.com/u/atipico)\
**Post date:** [February 18, 2011, 11:16am UTC](https://www.ruby-forum.com/t/block-access-to-every-file-in-the-site-but-index-htm/203342/5 "2011-02-18T11:16:54Z")

</div>

I think this is the pointed solution, isn’t it?

[http://nginx.org/pipermail/nginx/2009-June/012814.html](http://nginx.org/pipermail/nginx/2009-June/012814.html)  
[http://wiki.nginx.org/HttpUserIdModule](http://wiki.nginx.org/HttpUserIdModule)

Thanks!

Posted at Nginx Forum:

> **[Re: Block access to every file in the site but index.htm](https://forum.nginx.org/read.php?2,176352,176416#msg-176416)**
>
> I have a site with just one file: index.htm witch have some ajax linked to php files. I'd like to make thouse php files only accessable via ajax (post and get) coming from this index file and block access to all files but the index.htm. Is it...

---

<div class="post-metadata">

**Author:** ![atipico](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@atipico](https://www.ruby-forum.com/u/atipico)\
**Post date:** [February 18, 2011, 11:34am UTC](https://www.ruby-forum.com/t/block-access-to-every-file-in-the-site-but-index-htm/203342/6 "2011-02-18T11:34:31Z")

</div>

On 02/18/2011 06:15 PM, atipico wrote:

> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)  
> no, you cannot protect anything in nginx, its just a first step  
> protection. your server should support session.

and $http\_referer needs to be checked.

---

<div class="post-metadata">

**Author:** ![atipico](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e8cbc/32.png) [@atipico](https://www.ruby-forum.com/u/atipico)\
**Post date:** [February 18, 2011, 12:41pm UTC](https://www.ruby-forum.com/t/block-access-to-every-file-in-the-site-but-index-htm/203342/7 "2011-02-18T12:41:07Z")

</div>

But how to work with sessions if my first page is a static page? Should  
I create a session via Ajax?

Posted at Nginx Forum:

> **[Re: Block access to every file in the site but index.htm](https://forum.nginx.org/read.php?2,176352,176432#msg-176432)**
>
> I have a site with just one file: index.htm witch have some ajax linked to php files. I'd like to make thouse php files only accessable via ajax (post and get) coming from this index file and block access to all files but the index.htm. Is it...