Block RSS feed on 1.7 magento?

Question

I followed Magento instruction and added the following rule in the root .htaccess file (inside IfModule mod_rewrite.c>): RewriteRule ^(index.php/?)?rss/ - [L,R=403]

I still can access RSS request page: /index.phprss/catalog/notifystock

Any idea how to block RSS access on 1.7 magento?

https://magento.com/security/best-practices/protect-your-magento-installation-password-guessing-new-update

P.S. I found on the website https://support.hypernode.com/knowledgebase/how-to-protect-your-magento-store-against-brute-force/

"Because the RSS endpoint is reachable under various locations, it is generally not possible to filter RSS when using Apache (without using mod_rewrite). It is recommended to upgrade to at least version 1.9.3 and disable RSS in the backend."

Answer 1

If possible, I would recommend just disabling the Mage_Rss module. See Marius' answer on this question for an example of how to disable core modules.

https://magento.stackexchange.com/a/2664/2241

Zookal has done some research on what modules can be disabled without problems. Of course, if they are not being used. Mage_Rss is on their list of safe modules to disable (see list at the bottom of the page).

http://zookal.github.io/magento-mock/etc/challenges.html

Answer 2

This is what I use to block RSS brute-force.

Right after this block in .htaccess:

############################################
## you can put here your magento root folder
## path relative to web root

    #RewriteBase /magento/

I add this line:

###########################################
## Disable RSS URLs
    RewriteRule ^/?(index.phprss|index.php/rss/catalog|index.php/rss/order|rss/catalog|rss/order).*$ /no-route [R=301,L,NC]

Answer 3

Use this rule

RewriteRule ^(index.php/?)?rss/ - [L,F]

instead of the official one:

RewriteRule ^(index.php/?)?rss/ - [L,R=403]

[F] is the semantically correct flag to [F]orbid access.

The reason the official one doesn't work for you might be because of using an older Apache and corresponding mod_rewrite version. It's not fully clear from the mod_rewrite documentation, but in contrast to Apache v2.2 and v2.4, the v2.0 docs don't mention that status codes other than 300-400 are supported. As a result, the rule containing the flag [R=403] as suggested by Magento itself may be skipped under Apache 2.0.

If this is the root cause, then Magento should rework either their system requirements – as they're officially supporting Apache 2.x – or their RSS blocking RewriteRule.

v2.0 docs on [R] flag

'redirect|R [=code]' (force redirect)

Prefix Substitution with http://thishost[:thisport]/ (which makes the new URL a URI) to force a external redirection. If no code is given, a HTTP response of 302 (MOVED TEMPORARILY) will be returned. If you want to use other response codes in the range 300-400, simply specify the appropriate number or use one of the following symbolic names: temp (default), permanent, seeother. Use this for rules to canonicalize the URL and return it to the client - to translate /~'' into/u/'', or to always append a slash to /u/user, etc.

[...]

v2.2 and v2.4 docs on [R] flag

[...]

Any valid HTTP response status code may be specified, using the syntax [R=305], with a 302 status code being used by default if none is specified. The status code specified need not necessarily be a redirect (3xx) status code. However, if a status code is outside the redirect range (300-399) then the substitution string is dropped entirely, and rewriting is stopped as if the L were used.

[...]

Answer 4

To Block RSS brute-force attack. Add that rule in root .htaccess file. Modified answer of @Richard Feraro

Note: it should be written before enable rewrites code RewriteEngine on

<IfModule mod_rewrite.c>

RewriteRule ^/?(index.phprss|index.php/rss/catalog|index.php/rss/catalog/notifystock|rss/catalog/notifystock|index.php/rss/order|rss/catalog|rss/order).*$ / [R=301,L,NC]

</IfModule>

Answer 5

Try this

RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L] 

RewriteCond %{HTTPS} on
RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC] 
RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [OR,NC]
RewriteCond %{REQUEST_URI} ^.*RSS/CATALOG [NC]  
RewriteRule ^(.*)$ https://%{HTTP_HOST}/ [R=302,L] 

Answer 6

1. System -> Configuration
2. Search RSS Feed.
3. In the Catalog section, you will find RSS Feed option. Disable it from this panel.
4. After disabling refresh the cache.