Deny direct browser access to `/static` URLs / different cache folder

[sebastiangreger]

Should the /static folder be blocked from direct access via URL? (…either a .htaccess file in that folder or instructions in Readme)

Reasoning:

• avoid getting this technical folder indexed, with potential SEO duplicate content issues
• maybe some security implications (can't immediately think of any, though)

…or maybe this folder should be placed under site/static or even site/cache/static in the first place, to take it out of public reach and semantically make it part of Kirby's "internals"?

[bastianallgeier]

I think you are right. It would be kind of cool to have a redirect rule for everything in the static cache. I.e. in case you hit /static/photography/index.html you get redirected to /photography.

I also thought about putting it in the site folder, but that's less flexible when you want to use a public folder setup.

[iskrisis]

This would also fix blocking /static as possible Page in Kirby. Problem i had with /media in the past. Now that i think about it i should have fixed these /media issues in similar way by moving it out of public and making redirect.

[bastianallgeier]

I guess it would be best to have a configurable root option for the static cache. Then you could decide for yourself where it should be living.

[iskrisis]

@bastianallgeier should it be new root option when you already have to set it up in config.php? Shouldn't it live there?

[bastianallgeier]

@iskrisis not sure what you mean

[iskrisis]

@bastianallgeier I think i misunderstood i thought you want to make new $kirby->root('staticache') but you probably meant the same as me

  'cache' => [
    'pages' => [
      'active' => true,
      'type' => 'static',
     `root`=> '/yady/dada`
    ]
  ]

Anyway personally i like putting it somewhere into $kirby->roots('cache') by default. As @sebastiangreger proposed.

[lukasbestle]

I like the idea to put it in site/cache. Also fits from the semantics. The root could still be overridden by those who use a public folder setup.

[lukasbestle]

✅