N Apache2 directive to explicitly set directory listings 403 Forbidden

apache-2.4

Is there a directive to explicitly set directory listings without an index file to 403 Forbidden? The default behavior returns a 404 because mod_dir can't find the index file.

I don't have mod_autoindex loaded and Options are set to just FollowSymLinks. I tried -Indexes, but that still returned a 404.

<IfModule dir_module>
    DirectoryIndex index.php index.html index.htm
    DirectorySlash On
</IfModule>

<Directory /var/www>
    Options FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

I shouldn't matter, but I'm using Apache 2.4.

Best Answer

Answering my own question after a lot of trial and error. This answer should apply to Apache >= 2.0.

In summary, it seems the Indexes option for the Options directive requires mod_autoindex. You can stop reading now unless you'd like more info on the default Apache behavior.

More Info

The key is whether or not mod_autoindex is loaded. If it's not loaded, setting Options -Indexes will have no effect and return a 404, which makes sense because the mod_dir DirectoryIndex directive can't find your index file. If it is loaded, setting Options -Indexes will return a 403.

This is somewhat explained in the Apache Options docs under Indexes, which is a little confusing because Options is a part of mod_core.

Indexes

If a URL which maps to a directory is requested, and there is no DirectoryIndex (e.g., index.html) in that directory, then mod_autoindex will return a formatted listing of the directory.

... and explained on the mod_autoindex page:

Automatic index generation is enabled with using Options +Indexes. See the Options directive for more details.

My tests indicate that enabling/disabling .htaccess files with AllowOverride is irrelevant.

Related Topic