Received: by taz.hyperreal.com (8.7.6/V2.0) id OAA24106; Sun, 17 Nov 1996 14:41:24 -0800 (PST) Received: from eat.organic.com by taz.hyperreal.com (8.7.6/V2.0) with ESMTP id OAA24101; Sun, 17 Nov 1996 14:41:21 -0800 (PST) Received: from localhost (brian@localhost) by eat.organic.com (8.7.5/8.7.3) with SMTP id OAA10091 for ; Sun, 17 Nov 1996 14:41:47 -0800 (PST) Date: Sun, 17 Nov 1996 14:41:46 -0800 (PST) From: Brian Behlendorf To: new-httpd@hyperreal.com Subject: along with satisfy, there's "referer" and "OnDeny" - ugh! Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: new-httpd-owner@apache.org Precedence: bulk Reply-To: new-httpd@hyperreal.com http://hoohoo.ncsa.uiuc.edu/docs/setup/access/Overview.html Lists two *other* directives within which we'd need to support to claim "full" NCSA-1.5 compatibility: "referer" and "ondeny": [referer] The purpose of the referer directive is to force users to enter a document from a specified path, instead of jumping in at random. It allows the webmaster to specify an exact match or wildcard expression to match the Referer: HTTP header. See the new OnDeny directive as a way to send the browser to the correct entry point. Note: This is not perfect. There is nothing to prevent a user from accessing the directory if they are able to modify the Referer: header that is sent with their browser. [ondeny] The purpose of the OnDeny directive is to provide for non-HTTP based access control, such as via the referer directive. It causes a browser which fails the Limit to go to a specified URL. Ugh!! Both directives' functionalities could be accomplished with a combination of other Apache directives - if our goal is to claim complete NCSA 1.5 compatibility, we should articulate how to do that. Brian --=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-- brian@organic.com www.apache.org hyperreal.com http://www.organic.com/JOBS