IBM WebSphere V5.0 Security - CGISecurity

A .htaccess file placed in one directory applies to all its subdirectories. In such a
case it is equivalent to a section in the httpd.conf file. If there is more
than one access files in a directory tree, the directives set in a file for
subdirectory take precedence over the directives in the parent directory.
There are a number of directives that can be overridden. When dealing with
security, we are interested in the AuthConfig category of directives that will allow
the use of authorization directives such as AuthUserFile, AuthGroupFile,
AuthDBMGroupFile and others. To override this category, change the directive in
httpd.conf file to:
Example 4-3 Security configuration in httpd.conf
AllowOverride AuthConfig
Options None
For more information on how to use .htaccess see the Apache tutorial at:
http://apache-server.com/tutorials/ATusing-htaccess.html
The drawback of using .htaccess files is a negative impact on the performance of
the Web server. As mentioned before, when the use of .htaccess files is enabled,
for any resource requested from one directory, Web server also checks all parent
directories for .htaccess files and tries to merge the configuration in order to
decide whether the user is entitled to read the resource or not.
The other problem with the .htaccess files is the system management. It is
difficult to maintain, especially in a centralized security infrastructure.
4.1.3 Other Web server security aspects
This book is not dedicated fully to discussing Web server security, and a sample
scenario only has been chosen to show how to secure Web server using LDAP
user registry. This LDAP server can be shared with the application server in order
to manage a user’s authorization to specific Web application resources. This is
discussed in the following chapters.
However, when writing about Web server security, it not necessary to mention
other possible means that can be used to secure either the Web server daemon
process or user access to Web server resources. Next is a short list of what you
can take into account for securing the Web server when designing the system to
run secure Web applications:
44 IBM WebSphere V5.0 Security Handbook