Deny/hide access to files starting with dot, like . git, . svn, . Ds_store, . yml

Question

By default Apache denies access to files whose name begins with .ht, as an example .htaccess:

<Files ~ "^\.ht">
    Require all denied
</Files>

But I notice that many files use the prefix ., like the .gitignore. I believe that this file does no harm, I still think that the use of the point in the prefix is "strongly" directed to configuration files. I think it might be interesting to deny access to these files in general by doing something like:

RewriteEngine On

# Checa se o arquivo existe
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{REQUEST_FILENAME} -f

# Emite status HTTP 403
RewriteRule ^(\.|/\.) - [F,L]

In IIS maybe it’s something like:

<rule name="Redirect to routes" stopProcessing="true">
    <conditions>
        <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
        <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
    </conditions>
    <match url="^(\.|/\.)" ignoreCase="false" />
    <action type="AbortRequest" />
</rule>

Add the file check because if the file does not exist it should emit 404 and not 403.

This would be a "good use", or maybe the . as prefix has other uses besides settings files?

If this then trade for a "group" of file types:

(^|/)\.(git|gitignore|yml|svn)$

Answer 1

For file server case, it is more reliable to block direct access to files/directories that start with prefix ., because it usually contains configuration information that can be confidential, better lock by default and release by whitelist. I found that article which largely deals with your doubts. Excerpt from this article:

Disabling Hidden files Both on the request side and the file serving side should Protect you from Leaking Hidden files, Barring other application security holes.

In free translation:

Disabling hidden files, both on the request side and on the file service side, should protect you from leaking hidden files by blocking other security holes in the application.

Of course, it depends a lot on how your project and your deploy; if you make a deploy zip extraction, and zip ensure that you will not have the files with confidential information (for example, using a make package.zip that will compress all your scripts into a zip).

For links that have as suffix o . but that do not redirect to files (such as you yourself commented), has no restrictions. For example, the Wikimedia is all written in PHP, often with deploy to run on Apache Server and intercept the URL and interpret what needs to be sent, not serving the file directly (with the exception of files uploaded).

Answer 2

This is the solution I have been using otherwise would be directed all files with extension to the right of the . And so all the files started by .giti are directed elsewhere.

<Files ~ "^\.(htaccess|htpasswd)$">
deny from all
</Files>
ErrorDocument 404 /pt/404.php
RewriteEngine on
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*) https://www.exemplo.com/$1 [R=301,L]
DirectoryIndex index.php       
Redirect permanent /^(.giti*) /index.php
order deny,allow