Is there a directive to explicitly set directory listings without an index file to 403 Forbidden? The default behavior returns a 404 because mod_dir can't find the index file.
I don't have mod_autoindex loaded and Options
are set to just FollowSymLinks
. I tried -Indexes
, but that still returned a 404.
<IfModule dir_module>
DirectoryIndex index.php index.html index.htm
DirectorySlash On
</IfModule>
<Directory /var/www>
Options FollowSymLinks
AllowOverride None
Require all granted
</Directory>
I shouldn't matter, but I'm using Apache 2.4.
Best Answer
Answering my own question after a lot of trial and error. This answer should apply to Apache >= 2.0.
In summary, it seems the
Indexes
option for theOptions
directive requires mod_autoindex. You can stop reading now unless you'd like more info on the default Apache behavior.More Info
The key is whether or not mod_autoindex is loaded. If it's not loaded, setting
Options -Indexes
will have no effect and return a 404, which makes sense because the mod_dirDirectoryIndex
directive can't find your index file. If it is loaded, settingOptions -Indexes
will return a 403.This is somewhat explained in the Apache Options docs under Indexes, which is a little confusing because
Options
is a part of mod_core.... and explained on the mod_autoindex page:
My tests indicate that enabling/disabling .htaccess files with
AllowOverride
is irrelevant.