logo
Apache Lounge
Webmasters

 

About Forum Index Downloads Search Register Log in RSS X


Keep Server Online

If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.

or

Bitcoin

A donation makes a contribution towards the costs, the time and effort that's going in this site and building.

Thank You! Steffen

Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
Post new topic   Forum Index -> Apache View previous topic :: View next topic
Reply to topic   Topic: Apache WebServer (local use query)
Author
freestyler



Joined: 21 May 2021
Posts: 5
Location: UK

PostPosted: Fri 21 May '21 11:58    Post subject: Apache WebServer (local use query) Reply with quote

Hi,

I have a local application that needs to communicate with a RESTful API using PHP. Instead of setting up a web server, I would much prefer to use a web server on the local machine/in house file server.

I can setup Apache Web Server to run on local host and this works perfect. My main concern is security as I have read many times that you should only use Apache Web Server for local development. The web server would be configured to only accept local connections, and should be off limits to anyone else outside the office. Can anyone advise me on whether this is a good idea or not, and what alternatives I have (other than setting up a VPS, which seems overkill for a few simple REST API queries per day.

Any help would be much appreciated

Kind regards
Back to top
tangent
Moderator


Joined: 16 Aug 2020
Posts: 305
Location: UK

PostPosted: Sun 23 May '21 11:46    Post subject: Reply with quote

I'm surprised by your statement that Apache should only be used for local development. Properly configured and maintained, Apache can provide first class site security, matching that of any other leading web server, e.g. Nginx. Indeed, there's a reason Apache currently hosts over 30% of web sites out on the net.

If you're simply looking to restrict which clients or subnets can connect to your server, you can use various IP based access control constructs such as:

Code:
<RequireAll>
    Require all granted
    Require ip 10.0.0.0/8
</RequireAll>

Start with official documentation links:
There's plenty of additional information and worked examples out there to help with site access control and hardening.
Back to top
freestyler



Joined: 21 May 2021
Posts: 5
Location: UK

PostPosted: Mon 24 May '21 7:23    Post subject: Reply with quote

Thanks tangent for clearing that up for me.

I have read many times to not use Apache Webserver for anything other than local testing, always citing security concerns.

Thanks again for taking the time to reply.
Much appreciated
Back to top
Jan-E



Joined: 09 Mar 2012
Posts: 1248
Location: Amsterdam, NL, EU

PostPosted: Mon 24 May '21 13:39    Post subject: Reply with quote

freestyler wrote:
I have read many times to not use Apache Webserver for anything other than local testing, always citing security concerns.

That might be statements about the default config of distributions like XAMMP, but properly configured Apache is as safe as any other webserver.
Back to top
freestyler



Joined: 21 May 2021
Posts: 5
Location: UK

PostPosted: Tue 25 May '21 11:46    Post subject: Reply with quote

That's it Jan-E! I was getting mixed up there, it's actually what I was referring to.

Could Xampp be setup to be secure? Could I configure it to only accept local connections? Would this then be secure enough? Or is Xampp only for testing?
Back to top
freestyler



Joined: 21 May 2021
Posts: 5
Location: UK

PostPosted: Tue 25 May '21 12:13    Post subject: Reply with quote

To communicate with the required RESTful APIs, I must do this via PHP. I don't want to actually go and set up a real web server. Ideally all the computers in the office will have access to a local web server.

Any ideas on the best approach?
Back to top
James Blond
Moderator


Joined: 19 Jan 2006
Posts: 7288
Location: Germany, Next to Hamburg

PostPosted: Fri 28 May '21 9:38    Post subject: Reply with quote

There is a tutorial for that on AL
https://www.apachelounge.com/viewtopic.php?t=2394

Plus you can add the suggested RequireAll from tangent, or use Require local see https://httpd.apache.org/docs/2.4/mod/mod_authz_host.html
Back to top
freestyler



Joined: 21 May 2021
Posts: 5
Location: UK

PostPosted: Fri 28 May '21 13:37    Post subject: Reply with quote

Excellent! Much appreciated Mr Blond!
Back to top


Reply to topic   Topic: Apache WebServer (local use query) View previous topic :: View next topic
Post new topic   Forum Index -> Apache