Search code examples
phplaravel.htaccesslaravel-8vhosts

Laravel - prevent file access outside of public while deployment is in subfolder

I am relatively new to laravel so pardon me if it is a bad practice. I have a godaddy domain lets say example.com which is pointed to my ec2 instance. I have 2 projects example.com website and Admin. so my folder structure is

  • /var/www/html
    • website
    • admin

I wanted to point example.com to point /website so I managed that from virtual host like below

<VirtualHost *:443>
  ServerName example.com
  DocumentRoot "/var/www/html/website"
</VirtualHost>

This works as expected.

now I wanted to access admin panel by example.com/admin
for that, I created symlink in /website as admin which is pointing to /admin folder.
With above aproach, I can access admin using example.com/admin/public which is as per my expectation as all users are already using /public url.
Now the problem is when I access example.com/admin/ without public, it shows all the files outside of public and also I can see the .env file using url. How can I avoid this?

Solution

  • Well, I found a good solution
    First, I added .htaccess file with following lines

    RewriteEngine On 
RewriteRule ^ public [L]

    This redirected everything to /public

    Second, for extra security, I restricted access to .env file using

    <Files .env>
order allow,deny
Deny from all
</Files>

    Still I would like to have some suggesions if any. Thank you.