Is it best practice to restrict direct access to view files? Or I just need to restrict direct access to my controllers and models? Please give me suggestions.thanks

If your views are in the application folder, they are already restricted.

Yes, it is best practice (just to confirm that part.)  But as Aken said, if the views are in the application folder, they are already restricted.

I generally set up my application to where everything except index.php and my assets folder (images and css) are outside of the web root in order to make securing it all a bit easier.

Aken - 08 August 2012 01:48 AM

If your views are in the application folder, they are already restricted.

Assuming you are on an Apache server.

Yeah they should already be restricted by default!

Thank you very much for all ur help guys! So it means I dont need to restrict it manually because it is safe when it is in the applications folder