Newbie question - Hide a file

I plan to have a client-side application (not a browser) pass an encrypted
user name and password to a php file for validation, which will return an
xml string if the user is validated.

Obviously I don't want Apache to serve up that php file to any browser or
other app that asks for it. How do I prevent that from happening?

Alternatively, is there a better method to accomplish what I'm trying to do?

On Sun, 27 Jan 2008 14:17:15 -0800, "Paul Pedersen"
<nospam RemoveThis @no.spam> wrote:

> I plan to have a client-side application (not a browser) pass an encrypted
> user name and password to a php file for validation, which will return an
> xml string if the user is validated.
>
> Obviously I don't want Apache to serve up that php file to any browser or
> other app that asks for it. How do I prevent that from happening?

First off all, apache doesn't "serve up" .php if you
configure it to run the script. It just runs the php
script and the script decides what the response should be.

You can't prevent a browser or other app to try to do the
same as your app. It's apache, so your app will send a
request like:
GET /validate.php?u=encrypteduid&p=encryptedpsw HTTP/1.1
or
POST /validate.php HTTP/1.1
with the encrypted userID/password in the request header.
Any socket capable program can imitate that.

if the request is well-formed you can't prevent Apache
from triggering the .php script, regardless the client
which composed it.

Just a few possibilities:

1) You can obfuscate by using an uncommon port (not 80 or
8080).

2) You can obfuscate by sending an uncommon query string
GET /validate.php?somestring_with_encrypted_uid_and_psw

3) You can obfuscate by leaving out the .php extension and
using the trick in
http://richardlynch.blogspot.com/2006/06/php-downloads-content-disposition.html
4) Your php script can refuse to answer invalid requests,
either by sending nothing or sending a 403 response and
disconnecting.

4) Require a valid client certificate.

6) A combination of 1) thru 5)

7) Of course your encryption is perfect and your script
will only send the .xml file if the userID and password
are correct, so what do you worry about?

> Alternatively, is there a better method to accomplish
> what I'm trying to do?

It will have been done before, but I don't know any
examples.

HTH
--
( Kees
)
c[_] Se cio` che dici non offende nessuno, vuol
dire che non hai detto nulla. (Oscar Wilde) (#94)