Ico

[jscheuer1]

Couldn't a creative server admin like yourself, Twey, set something up in the config, or the .htaccess to deny service of /favicon.ext to any folder other than the root? I know next to nothing about how that might work though.

Couldn't one even direct that a .favicon.ext (or any other file) be served instead?

[Twey]

No — the request for the page and the request for the favicon are two entirely separate requests. There's no state passed between them (except cookies, but that breaks if the browser loads two pages at once).

[jscheuer1]

I was thinking (like):

Redirect 301 /favicon.ico /subfolder/favicon.ico

placed in a .htaccess file in the /subfolder/ directory.

Edit: By the way, here's a scary article about favicon:

http://www.w3.org/2006/WSC/wiki/Reco...posals/FavIcon

I had never thought of them in those terms before.

[Twey]

I realise what you were thinking, but there's no way to tell what 'subfolder' is. All the server sees is a request for /favicon.ico; it doesn't know the page for which the browser wants that icon.

With regards to spoofing a secure connection by means of a favourites icon: yes, that's always been a risk, and it's one reason why pages shouldn't really be allowed to affect the chrome at all.

[jscheuer1]

I don't have an environment to test this idea out in. But the page request would occur in a subfolder, so the server could know, at least in theory. But since I have neither the need or availability to try this out, I'll take your word for it.

My thinking, and I may even have misunderstood this much, was that .htaccess, if placed in a subfolder can be in effect for only that subfolder.

[Snookerman]

My thinking, and I may even have misunderstood this much, was that .htaccess, if placed in a subfolder can be in effect for only that subfolder.

I was wondering the same thing after you posted about this before so I did a search and most articles seem to agree with that: the .htaccess file affects only the folder it is in.

[jscheuer1]

I was wondering the same thing after you posted about this before so I did a search and most articles seem to agree with that: the .htaccess file affects only the folder it is in.

Yes, but I think Twey is far more experienced with Apache and .htaccess files. I understand what he is saying, that under that regimen, the request for /favicon.ext is perhaps treated literally regardless as to what is in the .htaccess file.

This would certainly be true if .htaccess can only 301 redirect pages for instance. And there could be other vagaries of the .htaccess interface that would prevent it from working effectively for a resource called from a page, as it may already be cached in the browser. But if it is simply the later, some sort of no-cache, or must renew directive might be able to overcome that.

There could be other considerations. But if this can be worked out, I'm sure many host admins would be interested.

[Twey]

While you can indeed serve /subfolder/favicon.ico for a request to /favicon.ico, it would only work for one specific directory. That is, all requests for /favicon.ico would be redirected to /subfolder/favicon.ico, even if the previous request the user's browser made was for /subfolder2/page.html. This is because the server, at the point at which /favicon.ico is requested, has no idea of the page that told the browser to request /favicon.ico. This is necessarily true, regardless of limitations or lacks thereof of the server in question, because HTTP is a stateless protocol. File requests are entirely independent of one another.

[jscheuer1]

I'm really having trouble following, and I wish I had an environment where I could test this, at the very least it would help me to understand what you are saying. You mean that if there is a .htaccess in /subfolder that is as limited to that folder as is possible to make it, it will affect requests made in other folders?

How about a .htaccess file in all folders redirecting /favicon.ext to .favicon.ext?

[Snookerman]

I don't really understand why having the index.ext page in a folder showing is different from having the favicon.ext show for that folder. When I type in the address http://www.example.com/folder/ the browser should look for files in that folder that are called index.ext, favicon.ext, .htaccess, etc and display/use them.

If the files are not there then nothing should display. If the problem is that the browsers do this in a different way at the moment, then they should think about this for future releases and maybe in a few years there will be no problems. The favicon could be compared to the folder.jpg that shows as the default folder thumbnail in Windows. I'm sure I'm overlooking and misinterpreting things but I'm sure you get my idea.