htaccess for nginx

Copyright (c) 2017-2019 by Roadfamily LLC

(Proprietary License)

htaccess for nginx enables nginx high performance webserver to deal with .htaccess files.

.htaccess files are mainly used for access control and URL rewrite instructions and are widely known across the web community. Originally designed for Apache, their implementation in nginx has been rejected, because of obvious performance concerns.

Why not stick to Apache?

• Apache is slow.
• Apache is wasting resources.
• Compared to nginx, Apache is poorly designed and inconsistently implemented.
• Apache's monolithic design prevents it from scaling properly, while nginx is capable of handling thousands of simultaneous connections with ease.
• Switching to nginx heavily improves performance, efficiency and security.

Reasons to implement htaccess for nginx

There are still legitimate reasons to support .htaccess in nginx:

• Legacy. Just use your old code, without worrying if someone could access a protected directory inside any library you just forgot to handle in your nginx config.
• Mixed technology. More and more web applications use NodeJS. When dealing with customer webspace, one could use Apache and nginx on one machine (one proxying the other), however this adds an unnecessary layer of redundancy and heavily wastes server resources.
• Ease of use. Everybody knows how to use .htaccess files. More than 40% of all active websites out there are still run by Apache's webserver, capable of utilizing .htaccess files. If nginx had a way to support this feature, this number would be going down significantly.
• Apache performs multiple file reads anyway, so htaccess for nginx cannot make it worse, right? In fact, with our built-in micro caching mechanism both, CPU and I/O load are reduced drastically compared to Apache's implementation.

Performance

• This nginx htaccess plugin is pretty darn fast! It keeps getting optimized for performance. Even with low-end hardware it adds less than 1 millisecond to your response time, also for quite complex rewrite structures with server variables.
• Physical memory usage of this plugin is less than 10 KB for each nginx worker process.

Requirements

• nginx with Lua module
• cURL

Installation

• Install nginx with Lua module: apt-get install nginx
• Install Lua: apt-get install lua5.2
• Save this plugin directory into /etc/nginx/, so that you can access /etc/nginx/htaccess-for-nginx/htaccess.ljc
• Add the following configuration to your http {} context: lua_shared_dict htaccess 16m;
• Configure your hosts (within the server {} context): rewrite_by_lua_file /etc/nginx/htaccess-for-nginx/htaccess.ljc;

Hints and Common Practice

• Depending on your operating system, the installation process may vary.
• Make sure to have Lua version 5.2 installed on your system.
• You can clone this repository to any directory of your choice. Just make sure to adjust the paths accordingly.
• If you don't set the lua_shared_dict setting in http {}, this plugin will refuse to work. It represents a caching system, used on a short-term per-request basis. Values (htaccess lines) are usually cached less than 100 milliseconds. You can choose to assign any other memory amount to it, although 16m (16 MB) should be more than enough.
• ⚠️ Note that global configuration within your http {} context is technically possible. However, if you want to keep the good nginx performance for your new, non-legacy projects, you are highly encouraged to use this plugin in server {} context only.
• To make your life easier, just create a config snipped and write e.g. include snippets/htaccess.conf in the server {} config.

Usage

Try to create an .htaccess into the root directory of your host, restricting access:

Order deny,allow
Deny from all

When trying to access a file inside this directory via browser, access should be denied using an HTTP 403 response.

Support status of .htaccess Directives

The following directives are scheduled to be supported by this plugin.

• RewriteEngine (✓ Full Support)
• RewriteCond (✓ Full Support)
• RewriteRule (✓ Full Support)
• Order (✓ Full Support)
• Allow (✓ Partial Support)
• Deny (✓ Partial Support)
• Require (✓ Partial Support)
• AuthUserFile (unsupported)
• AuthName (unsupported)
• AuthType (unsupported)
• ErrorDocument (unsupported)
• AddType (unsupported)

Known Limitations

Certain feature are unsupported, due to performance reasons or other limitations.

• Some exotic flags and server variables are not available in RewriteRule and RewriteCond. Missing server vars are blanked out (silently replaced by empty strings to not match the specific rule) and unsupported flags trigger an error (HTTP 500).
• RewriteEngine has a bug: Multiple htaccess files within a directory tree aren't respected. The last directive found in the last subdirectory will determine its overall value.
• Allow/Deny from example.com is unsupported. You can only use IP addresses or ranges. In order to maintain good performance, hostnames will not be resolved.
• Require group will NOT be supported.
• Require host will NOT be supported.
• Require valid-user is not yet implemented.
• Require expr is not yet implemented.
• Blocks are unsupported. You cannot use something like <If> or <MatchAny>, however the instructions inside these blocks are parsed like they were outside of a block.
• Native SSI (Server-Side-Includes) cannot be used together with this plugin in the same host config (but for other hosts not utilizing this plugin).

Speaking of limitations, this plugin still tries to make things as secure as possible. Wherever an unclear situation occurs, access will be denied to prevent unintended access, e.g. if unsupported directives are being used (HTTP 500 response).

Download htaccess for nginx!

htaccess for nginx plugin is comercially available for download. However, you can test it for free.

• The price is $249 $79 USD per license — limited time offer!
• One-time payment, no monthly fees
• Large volume discounts available

If you happen to be disappointed, we guarantee giving 100% of your money back within the first 30 days after your purchase. Plus, you will receive free updates up to the next major version (at least to feature completeness, see schedule above).

Download — Test this plugin for free, limited to 100 requests per server (re)start.

Buy License(s) — Keep using this plugin without any limitations.