在读取正文之前拒绝 HTTP 请求
我正在开发一个网站，用户需要上传一些非常大的文件。该网站是用 PHP 编写的。
在某些情况下，我想根据标头拒绝文件。理想情况下，我想在收到标头后立即拒绝请求，而不读取正文。如果标头足以表明该文件应被拒绝，则没有理由读取 200M 的文件。此外，当我接受请求时，我想定期保存收到请求正文时读取的字节数。
我知道这对于 PHP 来说是不可能的，因为在 PHP 处理之前整个 HTTP 请求都会被读取。我有什么选择？我从未使用过 Perl，但我读到 mod_perl 可以访问 Apache API。使用 mod_perl 可以做到这一点吗？ Apache 模块？
I'm working on a website where users will need to upload some very large files. The site is written in PHP.
There are some instances where I'll want to reject a file based off the headers. Ideally, I'd like to reject the request as soon as the headers are received without ever reading the body. There's no reason to read a 200M file if the header is enough to tell that the file should be rejected. Additionally, when I do accept a request, I'd like to periodically save the number of bytes read as the request body is received.
I know this is impossible with PHP because the entire HTTP request is read before PHP gets its hands on it. What are my alternatives? I've never worked with Perl, but I was reading that mod_perl gives access to the Apache API. Would it be possible to do this using mod_perl? An Apache module?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
使用标准 PHP 处理程序基本上是不可能的。在解析请求之前你不会收到请求，不幸的是没有好的方法可以推迟它。
编辑：我在使用commons fileupload库的流模式和java方面有很好的经验。合并到 Apache 配置中有点混乱，但如果您正在谈论 200M 文件，那么节省的带宽是值得的。
Largely impossible using the standard PHP handlers. You don't get the request till its been parsed and there is unfortunately no good way to defer that.
EDIT: I've had good experience using the commons fileupload library's streaming mode and java. A bit messy to merge into an Apache config, but well worth the bandwidth savings if you are talking 200M files.
如果您可以硬编码拒绝文件的规则，则可以在 .htaccess 中使用 mod_rewrite 规则。使用 %{HTTP:header} 条件：
If you can hard-code rules for rejecting a file, you could use a mod_rewrite rule in .htaccess. Use the %{HTTP:header} condition:
modsecurity 可以与“简单”正则表达式一起使用。它出现在 Apache2 中并在接收到整个文件之前执行。您可以先阅读一下文档：
http ://www.modsecurity.org/documentation/modsecurity-apache/2.5.5/modsecurity2-apache-reference.html
您也可以保留默认规则，因为它们也会禁止许多无用的访问，尽管这需要时间删除这些规则这实际上会阻止您自己的网站与许多网站正常工作，因此删除所有这些默认规则可能是一个好主意。
There is modsecurity that can be used with "simple" regex. That goes in Apache2 and is executed before the whole file is received. You can start by reading the docs a bit:
http://www.modsecurity.org/documentation/modsecurity-apache/2.5.5/modsecurity2-apache-reference.html
You may keep the default rules too since they will also forbid many useless accesses, although it takes time to remove those rules that actually prevent your own website to work right with many, so removing all of those default rules could be a good idea.