Is it safe to have tell Apache server to handle .js and .css files as PHP?

Question

Based on an answer I saw in this question: Link

I'm wondering, is this a safe thing to do?

Suppose I implement this and a page gets requested that has a couple of JS and CSS files linked to it. Are the textfiles simply sent or does the server first parse them? Don't have a server to test it right now.

Also, is this a common method of working? I'm thinking that setting up your files so you always get the correct implementation based on user input can be pretty hard when it comes to CSS and JavaScript.

Answer 1

As long as the .css and .js files that are linked are on a different server it should be safe. All you're telling apache to do is treat .css and .js files as php for the files it serves itself.

Answer 2

It's not common, by default Apache treats .js and .css files as static files, meaning it does not do any extra processing, it just sends them.

You can configure apache to funnel files of any extension through some kind of program(such as PHP), but it is uncommon for images, css, and other static files.

Answer 3

It's not unsafe, unless you're allowing users to upload css/js files.

Answer 4

For dynamic CSS and Javascript you dont' always have to have them in .js or .css files. What you can do there is actually link to a PHP script that generates them so that all other .js and .css files that aren't dynamic aren't parsed by PHP. Generally it is a bad idea to run everything, especially media files, through an app server/dynamic parsing unless absolutely necessary (same goes for .net, RoR, Django etc).

<link rel="stylesheet" type="text/css" href="mycss.css"/>

browser treats the same as:

<link rel="stylesheet" type="text/css" href="mydynamiccss.php?param=somevalue" /> // this one would be dynamic on params, location or something else maybe colors etc.

You can also take dynamic js or css and push it through rewrite so it does have the correct extension but it is actually a php file that is dynamic as well if you don't want your links and script tags to have incorrect extensions.

Answer 5

A big problem with this is that it would seriously hamper the ability of Apache to guide caching headers - it treats static files as much more readily cacheable than php files.

I would certainly never do this. I might also question why they are autogenerating javascript in such a large quantity. This answer is much more viable as a method of customising javascript behaviour.