.htaccess in a directory makes it disappear from its parent’s listing

.htaccessapache-2.2

I have an Apache server running on a linux box (say example.com). Inside the web root is a folder (http://example.com/docs/, locally /home/me/docs), with an automatically generated index of its subdirectories, enabled by its .htaccess:

Options +Indexes
IndexOptions FancyIndexing NameWidth=* FoldersFirst IgnoreCase SuppressDescription Charset=UTF-8 SuppressHTMLPreamble

Now, inside docs is docs/protected. This subdirectory has its own .htaccess:

AuthType "Basic"
AuthBasicProvider file
AuthUserFile /path/to/.htpasswd
#Require valid-user

Now, this is where it becomes weird (for me):

  • as is, with the commented line, protected is not password-protected (which is normal) and is visible on its parent's listing (also expected)
  • if I uncomment the Require valid-user, protected becomes password-protected (if I type the URL directly), but it also doesn't appear on its parent's listing any more.

Anyone can figure out what could cause that?


Edit: now I notice that if I type the URL of the protected directory, then enter the password, then go back to the listing without closing the browser, the listing is complete. In summary, the directory is hidden until I have given credentials to it. But I only want to protect its content, not its existence!


PS: This is with Apache/2.2.21 running on a Synology box.

Best Answer

And the answer is that the parent directory should have:

IndexOptions ShowForbidden

I lost two hours finding that.