0

I have an Apache/2.2.21 (Debian) webserver, which I disabled directory listing with Options -Indexes but now I got 404 error for a directory, but I think I should get a 403.

I have no idea why I get 404, rather than 403. What should I check?

I have disabled autoindex module, after it I got a 404 for every URL that request a directory listing (eg: www.somesite.com/dir ). How can I get a 403 for this. (The dir does exist)

As a try I also put Options -Index in the end of main config file (apache2.conf).

netmano
  • 269
  • 2
  • 12
  • What makes you think that a 403 is the correct response? The directory exists, but there's no web-accessible resource at the location - 404 is the proper response code. – Shane Madden Nov 15 '11 at 16:14
  • Not necessarily; with -Indexes, its not that there's no resource--its that there's a resource that the user does not have access to. – Andrew M. Nov 15 '11 at 19:51

2 Answers2

3

I had exactly the same problem and I found that the solution is as simple as:

  1. ENABLE mod_autoindex, otherwise you'll never get 403 for directory requests
  2. DISABLE Indexes in directory's Options setting for obvious reason
0

If you redefined Error 403 to missing resource, you'll get exactly this result Check accesslog for requested URL

Lazy Badger
  • 3,137
  • 15
  • 13
  • In the log I see 404 error. – netmano Nov 15 '11 at 20:04
  • Check accesslog for **requested URL** – Lazy Badger Nov 15 '11 at 20:16
  • The dir 2010 is exists on the site, and the following in the custom log: `xxx.xxx.xxx.xxx - - [16/Nov/2011:11:02:49 +0100] "GET /2010 HTTP/1.1" 301 545 "-" "CUT:browserinfo" xxx.xxx.xxx.xxx - - [16/Nov/2011:11:02:49 +0100] "GET /2010/ HTTP/1.1" 404 316 "-" "CUT:browserinfo"` – netmano Nov 16 '11 at 10:04
  • 301 status code in first answer means "for some reason redirect fired" obviously, and for **redirect target** (which doesn't exist) you get 404. At least I see it this way. Check httpd.conf or .htaccess for defined redirects – Lazy Badger Nov 18 '11 at 13:26