I ran into the following issue:On a website I want to prevent unauthorized access to a set of .xml files - the user has to authenticate first. Now it would be possible for an authenticated user to type the URL of the file I don't want them to see. To prevent this, I created a simple php script that checks user authentication, then serves up the XML (with appropriate Content-type header).At the same time, I put the following in the .htaccess file in the directory with .xml (and other) files:<Files ~ (.xml)>Order allow,denyDeny from allAllow from xx.yy.zz.tt (IP address of server)</Files>This did the trick - .xml files were not longer directly accessible, even for an authenticated user.  But here is the thing I don't understand:If I leave out the 'Allow from' line, the php script still manages to access the .xml files. It seems that the .htaccess is completely ignored when it comes to php.So my question is two fold:Is this expected behavior?If so, then what method would one use to prevent a php script from accessing a particular file (or group of files)?There is clearly a fundamental issue around .htaccess that I completely failed to grasp. Thanks for your insights.
Why does .htaccess not prevent a php script from accessing a file
php;htaccess
PHP doesn't work with the file over HTTP but directly on the filesystem, unless you access the file over HTTP using cUrl or file_get_contents('http://.../file.xml').If you want to prevent the files from being accessed without the user being authenticated first, place the files outside the public directory and serve them from there./files//public_html/index.phpNow, for the files...if ($user->isAuthenticated()) {    // set proper file header    // print out the file content from /files/}Documentation might help you get a grasp on what I have in mind... http://cn2.php.net/manual/en/function.readfile.php#48683This way you'll prevent anonymous users from accessing the files as those are not stored in a publicly accessible directory.