I have been investigating the possibility of securing my Invoiceplane installation with apache authentication, however have been struggling as I don’t quite fully understand how the publishing of the website structure is managed. Although I have been administrating Apache installations for 5-6 years, at times I still consider myself an amature.
The reasoning behind the enhanced security is that I wouldn’t want to allow the slightest possibility of a competitor having access to my Customer and Billing data. If I am able to utilise Apache auth I can further enhance the security again by whitelisting IP addresses and/or using something like fail2ban.
This is the snippet of text from the default .htaccess file that I’m struggling to fully interpret:-
I’ve checked over the mod_rewrite documentation and can see that the “not”-f expression is a reference to a file and “not”-d expression is a reference to a directory:-
The bit I’m quite stuck with is the [L] part and the effect that has on the URL request. The utlimate objective is to secure all directories apart from “/guest” as I would still like my customers to be able to utilise the online quote and invoicing features.
Current Apache documentation suggests that utilising a virtualhosts “.conf” file is better for performance and security then using a “.htaccess” file. I would like to go down that route if at all possible.
Thought I’d bump this to the top of the forum in light of the recent security issue – anyone who did set up their .htaccess file as suggested above wouldn’t have been exposed to the vulnerability.
And also require SSL and add a HSTS header and set your 403 error document to also use HTTPS:
SSLRequireSSL
Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
ErrorDocument 403 https://www.example.org/
There is still an issue with a request from a browser that hasn’t visited the site before getting a HTTP Authentication prompt via HTTP and not HTTPS, I haven’t yet worked out a solution to this at a .htaccess level, it is easy to solve at an Apache config file level – simply redirect all HTTP requests to the HTTPS VirtualHost.
If you have a favicon.ico file you well need to add an additional rule for that to prevent browsers that automatically request it from getting HTTP Authentication prompts when viewing invoices, for example:
Here is an updated set of rules for a .htaccess file to add HTTP Authentication as an additional layer of security to an InvoicePlane install, guests don’t need to login using HTTP Authentication but admins do: