I am using Laravel for web app. Uploaded everything on production and found out that some of the files can be directly accessed by url - for example http://example.com/composer.json

How to avoid that direct access?

7 Answers 11

Set Your document root as public directory, so other files will not be accessible directly. Look for it in Your apache/nginx/??? configuration files.

upvote
  flag
I am using Apache. Ok, but I don't want this public folder to appear in my URL. If I set my document root to public, I am bound to use /public to my url's.. – Yasen Ivanov
upvote
  flag
@YasenIvanov I don't understand what your complaint is at all. Surely at the moment you have to use /public/ at the start of your URLs? If you set your document root to the public directory then you won't. Why do you want to have /public/ at the start of all your URLs? – Chris
upvote
  flag
I don't want to have /public/ to my URLs - that's what I've said. If I set my document root to public directory it just doesn't allow me to get acces like this - domain.com - it says "Forbidden". If I type it domain.com/public I have access. The question is how to remove this /public/ from my URL's ? – Yasen Ivanov
upvote
  flag
@YasenIvanov I think, that You understood me and Chris wrong. When You set document root to public path, it will be Your root directory for web server, so no more /public/ in URL. – Giedrius Kiršys

That is incorrect. composer.json sits outside of the public directory and therefore should not be accessible. This means that your VirtualHost configuration is incorrect.

Please make sure that your path to your directory ends with /public.

upvote
  flag
I think that's because I've renamed server.php to index.php and added .htaccess file to the root directory. So is it wrong to remove public.index.php from URL in that way? – Yasen Ivanov
1 upvote
  flag
You shouldn't do any changes. index.php and .htaccess should be in a public directory only and shouldn't be modified. – Alexey Mezenin

It depends on the webserver your running. With Apache it would be .htaccess files whereas with Nginx it would be handled in the server configuration file.

up vote 23 down vote accepted

You're using wrong web server configuration. Point your web server to a public directory and restart it.

For Apache you can use these directives:

DocumentRoot "/path_to_laravel_project/public"
<Directory "/path_to_laravel_project/public">

For nginx, you should change this line:

root /path_to_laravel_project/public;

After doing that, all Laravel files will not be accessible from browser anymore.

upvote
  flag
But what about shared hosting? How do we do it there? @alexey-mezenin – Manish Shrestha

You Can Deny files in .htaccess too.

<Files "composer.json">
Order Allow,Deny
Deny from all
</Files>

With Apache, you can create .htaccess file in the root directory of Laravel project to rewrite all requests to public/ directory.

<IfModule mod_rewrite.c>
RewriteEngine on
RewriteRule ^(.*)$ public/$1 [L]
</IfModule>

Point the web server to the public directory in the project's root folder

project root folder/public

but if you don't have the public folder and you are already pointing to the root folder, you can deny access by writing the following code in .htaccess file.

<Files ".env">
Order Allow,Deny
Deny from all
Allow from 127.0.0.1
</Files>

in the above code, first we are denying from all and allowing only from the own server (localhost to the server) to get executed, and hence we can protect it from outside users.

Not the answer you're looking for? Browse other questions tagged or ask your own question.