How to prevent users from executing cgi scripts directly?

Question

Apache server. There is a python script in http/cgi-bin which is used to display some content on a page. But a user can then do \<website>/cgi-bin/<script_name> to access it directly, which is a bit ugly. Is it possible to prevent this? The same thing for favicon.ico on http/

Answer 1

It depends if the browser itself runs the script, in which case you can't block it. But if you have a another page that includes it or calls it locally then you can prevent web access to the /cgi-bin/ directory.

In the httpd.conf or vhost include .conf or in an .htaccess file you can put

<Directory "/full/absolute/path/to/website/cgi-bin">
    Require all denied
</Directory>

Apache Docs

As far as blocking the favicon.ico you can't if you still want people to see it in their browsers. Keep this in mind, anything you block access to, means the browser can't access it. So if you want to block the icon so no one can see it then it is easier to just delete the icon file.

Answer 2

<Directory /path/to/dir>
  DirectoryIndex file.cgi
</Directory>

See DirectoryIndex. This doesn't block the client from executing file.cgi, but it does mean that it doesn't have to be part of the URL.