2

Recently Magento updated the post: "Protect your Magento Installation from Password Guessing", see: https://magento.com/security/best-practices/protect-your-magento-installation-password-guessing-new-update

While in the original post they advised to put the following in the root .htaccess file:

RewriteCond %{REQUEST_URI} ^.*/ADMIN_PANEL_LOCATION [OR,NC]

RewriteCond %{REQUEST_URI} ^.*/DOWNLOADER [OR,NC]

RewriteCond %{REQUEST_URI} ^.*/RSS/CATALOG [OR,NC]

RewriteCond %{REQUEST_URI} ^.*/RSS/ORDER [NC]

RewriteCond %{REMOTE_ADDR} !^1.2.3.4

RewriteCond %{REMOTE_ADDR} !^5.6.7.8

RewriteRule ^(.*)$ http://%{HTTP_HOST}/ [R=302,L]

Now they seem to recommend the following approach:

# Whitelist an IP address for the admin panel
RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/)?admin/ - [L,R=403]

# Whitelist an IP address for the RSS feed
RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx
RewriteRule ^(index.php/?)?rss/ - [L,R=403]

and put this in the ./downloader/.htaccess file:

order deny,allow
deny from all
allow from xx.xx.xx.xx

I am not much expert on this subject, so I was wondering:

  1. if both the first and second method are good for Magento 1
  2. what the difference really is between one approach over the other and if there's one which is better

1 Answer 1

1

While both of them are basically ok the second one is still better due to the following reason:

With a return code 302 in the RewriteRule you redirect all these requests (which should not be allowed) to your shops' homepage again, which results in an additional request. If someone starts brute-forcing on these URLs you will generate an additional request, so basically you would support your own DoS.

With a HTTP return code of 403 you might end up on basic 403 page (more or less fancy, depending on server configuration) but there won't be any further requests to your Magento.

1
  • If I change [R=302,L] from the first method to [R=403,L], are the two methods above the same?
    – Antony
    Nov 12, 2016 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.