From nobody@hyperreal.com Thu Mar 27 08:37:26 1997 Received: by taz.hyperreal.com (8.8.4/V2.0) id IAA23293; Thu, 27 Mar 1997 08:37:26 -0800 (PST) Message-Id: <199703271637.IAA23293@taz.hyperreal.com> Date: Thu, 27 Mar 1997 08:37:26 -0800 (PST) From: Martin@hyperreal.com To: apbugs@hyperreal.com Subject: Access control for proxy does not work. >Number: 271 >Category: mod_proxy >Synopsis: Access control for proxy does not work. >Confidential: no >Severity: serious >Priority: medium >Responsible: apache >State: closed >Class: sw-bug >Submitter-Id: apache >Arrival-Date: Thu Mar 27 08:40:01 1997 >Last-Modified: Sun Apr 20 12:07:08 PDT 1997 >Originator: Martin.Kraemer@Mch.SNI.De >Organization: >Release: 1.2b8-dev >Environment: SVR4-intel >Description: I'm using apache with the mod_proxy module and the following access control(s): order deny,allow deny from all allow from 127.0.0.1 139.25.113.10 192.168.123.1 #allow from 139.25.112.104 Then I try to access http://www.geocities.com/ from the host 139.25.112.104 and get (correctly): [Thu Mar 27 17:06:54 1997] access to proxy:http://www.geocities.com/ failed for pgtd0119, reason: Client denied by server configuration pgtd0119 unknown - [27/Mar/1997:17:16:42 +0100] "GET http://www.geocities.com/ HTTP/1.0" 403 1089 But when I send a second request http://www.geocities.com/foo.bar then the server passes the request to www.geocities.com, i.e., it performs the proxy service that should be disallowed: pgtd0119 unknown - [27/Mar/1997:17:16:53 +0100] "GET http://www.geocities.com/foo.bar HTTP/1.0" 404 1064 BTW: It would be nice if proxy (or any) access could be limited on host+path level, not just host level. >How-To-Repeat: See above. >Fix: >Audit-Trail: State-Changed-From-To: open-closed State-Changed-By: coar@decus.org State-Changed-When: Thu Mar 27 09:50:58 PST 1997 State-Changed-Why: Closed by submittor request. State-Changed-From-To: closed-analyzed State-Changed-By: chuck State-Changed-When: Sun Apr 13 21:24:27 PDT 1997 State-Changed-Why: There is still a bug when URL does not end in / State-Changed-From-To: analyzed-closed State-Changed-By: chuck State-Changed-When: Sun Apr 20 12:07:08 PDT 1997 State-Changed-Why: Use a block instead of a block to restrict proxy access. Docs are being updated to reflect this. >Unformatted: Kraemer Reply-To: Martin.Kraemer@Mch.SNI.De X-send-pr-version: 3.2