Category: Apache

Fixing “Size of a request header field exceeds server limit.” error

October 15, 2021

This error from Apache is typically caused by a very large cookie. In Apache the “LimitRequestFieldSize” directive sets this limit. The default is 8190 bytes. To change the file create a file at: /etc/httpd/conf.d/custom.conf or /etc/apache2/conf.d/custom.conf containing the desired change: LimitRequestFieldSize 16384 Reload Apache after adding the file with: /sbin/service apache2 restart or /sbin/service httpd restart

Clearing PHP opcache

May 5, 2021

Great article on how to clear the PHP opcache: https://ma.ttias.be/how-to-clear-php-opcache/ To facilitate use on a Plesk server created script and mapped into namespace: https://acme.com/opcache_clear Here’s the script: And here’s the Apache config to map into a virtual host: This above config should be placed in the “Apache & nginx setting” screen in the “Additional directives for https” field. In addition to setting the alias path we’re also setting the PHP handler. Additionally under “Password protected directories” added password protection for “/opcache_clear”. This is just a placeholder for the password file which is referenced in the above config.

Apply Basic Auth To Site With Excluded Virtual Path Under Plesk With Apache 2.4

March 23, 2021

We want to password protect a WordPress development site but allow unauthenticated access to the wp-json/ path. Hosting platform is Plesk with Apache 2.4. We’ll assume the domain is “acme.com” and the assigned IP is “w.x.y.z”. There are probably better ways to accomplish the goal but this approach seems to work. Step 1. – In Plesk add a Protected Directory named “/donotremove” and add appropriate user/passwords. Step 2. – In Plesk on the “Apache & nginx Setting” screen under “Additional nginx directives” add the following:

location ~ /wp-json {
	proxy_set_header AUTH_OVERRIDE true;
	proxy_pass http://w.x.y.z:7080;
	proxy_set_header Host $host;
	proxy_set_header X-Real-IP $remote_addr;
	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Accel-Internal /internal-nginx-static-location;
	access_log on;
}

location ~ /wp-json {

proxy_set_header AUTH_OVERRIDE true;

proxy_pass http://w.x.y.z:7080;

proxy_set_header Host $host;

proxy_set_header X-Real-IP $remote_addr;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

proxy_set_header X-Accel-Internal /internal-nginx-static-location;

access_log on;

}

Step 3. – In Plesk on the “Apache & nginx Setting” screen under “Additional directives for HTTP” and “Additional directives for HTTPS” add the following:

<Directory "/var/www/vhosts/acme.com/httpdocs" >

	# set an environment variable if there is an AUTH_OVERRIDE header
	SetEnvIf AUTH_OVERRIDE ^true AUTH_REQUEST

	# basic auth
	AuthName "Dev Login"
	AuthType Basic

	# password file is maintained from Plesk
	AuthUserFile /var/www/vhosts/system/acme.com/pd/d..httpdocs@donotremove
	<RequireAny>
		# require login
		Require valid-user
		# allow request if the environment variable is set
		Require env AUTH_REQUEST
	</RequireAny>
</Directory>

# set an environment variable if there is an AUTH_OVERRIDE header

SetEnvIf AUTH_OVERRIDE ^true AUTH_REQUEST

# basic auth

AuthName "Dev Login"

AuthType Basic

# password file is maintained from Plesk

AuthUserFile /var/www/vhosts/system/acme.com/pd/d..httpdocs@donotremove

# require login

Require valid-user

# allow request if the environment variable is set

Require env AUTH_REQUEST

</RequireAny>

</Directory>

.htaccess – negative file type match

March 20, 2019

Here’s an example of how to block all files extensions not listed in the regular expression:

<FilesMatch "(?<!\.xml|\.css|\.jpg|\.jpeg|\.png|\.gif|\.js|\.pdf|\.svg|\.ttf|\.woff|\.woff2|\.woff3|\.otf|\.eot)$">
        Order Allow,Deny
        Deny from all
</FilesMatch>

Order Allow,Deny

Deny from all

</FilesMatch>

Disable Basic Auth For Virtual Path On Plesk

February 16, 2018

In a recent case we needed to allow request to a particular virtual URL path on a site that was password protected with HTTP Basic Auth. The site was hosted on a Linux server with Plesk, nginx and Apache. Typically this problem is solved by adding a “Satisfy Any” to the .htaccess in the directory that you want to remove authentication. But this does not work if the path is virtual instead of a physical directory path. Additionally we needed to allow access for a list of IP addresses. We tried an number of different solutions and ended up with the following: Step 1 – The HTTP Basic Auth and IP access controls are configured in the .htaccess file like this:

# basic auth
AuthName "Authorized Only"
AuthType Basic
# password file is maintained from Plesk
AuthUserFile /var/www/vhosts/system/stage.acme.com/pd/d..httpdocs@donotremove
require valid-user

# set an environment variable if there is an AUTH_OVERRIDE header
SetEnvIf AUTH_OVERRIDE ^true AUTH_REQUEST

# set IP controls
order deny,allow
deny from all
allow from 1.1.1.1
allow from 2.2.2.2
# allow request if the environment variable is set
allow from env=AUTH_REQUEST

# require either Basic Auth or IP controls
Satisfy Any

# basic auth

AuthName "Authorized Only"

AuthType Basic

# password file is maintained from Plesk

AuthUserFile /var/www/vhosts/system/stage.acme.com/pd/d..httpdocs@donotremove

require valid-user

# set an environment variable if there is an AUTH_OVERRIDE header

SetEnvIf AUTH_OVERRIDE ^true AUTH_REQUEST

# set IP controls

order deny,allow

deny from all

allow from 1.1.1.1

allow from 2.2.2.2

# allow request if the environment variable is set

allow from env=AUTH_REQUEST

# require either Basic Auth or IP controls

Satisfy Any

Step 2 – In Plesk under:

Subscriptions -> stage.acme.com -> Apache & nginx settings -> Additional nginx directives

1	Subscriptions -> stage.acme.com -> Apache & nginx settings -> Additional nginx directives

Add the following block:

location ~ /excluded/path {
  proxy_set_header AUTH_OVERRIDE true;
  proxy_pass http://x.x.x.x:7080;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Accel-Internal /internal-nginx-static-location;
  access_log on;
}