Palliative: AllowOverride None As jerf (+1, great answer), stepping back a little... it has been ~fifteen years since we started noticing problems with htacces

Palliative: AllowOverride None As jerf (+1, great answer), stepping back a little... it has been ~fifteen years since we started noticing problems with htaccess. It filled a niche when webserver configuration was hard and when CRUD admin interfaces were significant work. Htaccess (and friends) should go now. I don't just mean "use the palliative above": I mean any time a remote client can potentially download or overwrite the ACL then the design is probably broken. (Apache is not alone here). With the myriad of possible use cases and massive deployed base apache is probably stuck with htaccess until extinction. Forever more, we will see this comment in httpd.conf: # The following lines prevent .htaccess and .htpasswd # files from being viewed by Web clients. Security is seldom well served by agile's "simplest thing that could possibly work". Worse, there is certainly other "best of breed" security stuff that we are doing right now that will be incontestably bad from a future viewpoint. What is that stuff?