How can I block direct access to my JavaScript files?

Asked 2011-06-13T20:01:14.737

I use Minify to minify and cache all my script requests. I only want my users to be able to access the minified versions of the JavaScript files.

Minify lies at www.example.com/min and my scripts are at www.example.com/scripts. How can I block direct access to doc_root/scripts which is where my unminified JavaScript files lie. I'd rather not put them out of the document root but it's an option.

Please note that I'm using Zend Framework, so the actual root of my application is shifted to www.example.com/public. An htaccess file handles the rewrite.

php javascript minify

Edit Report

2 Answers

Can't you just use an .htaccess file inside doc_root/scripts to prevent all access over the web to .js files over HTTP?

It won't stop minify, since that provides indirect access.

So in doc_root/scripts/.htaccess, something along the lines of

<Files ~ "\.js$">
    order allow,deny
    deny from all
</Files>

Note that the location of the .htaccess file matters in this case.

answered 2011-06-13T20:04:22.080

The only way is to check referers, and not everyone sends them, or sends a real one. In other words, you can't block direct access to anyone who really wants something. It's impossible to determine with 100% accuracy if a request is a direct one or is being done via a <script src=....> type request.

answered 2011-06-13T20:05:30.367

How can I block direct access to my JavaScript files?

2 Answers

Your Answer