Nginx autoindex feature

nginxSecurity

I'm deploying some sort of file exchange based on the assumption that the files are accessible only to the person which knows the folder path on the server (ex. mydomain.tld/privatesecretfolder/). I've enabled the autoindex feature in Nginx and created a dummy index.html file inside the document root.

Now my question: is it possible for someone to generate a directory index (with full view of the supersecretfolders) even when index.html is present?

Just as a reference the section which enables autoindexes:

    location ~/ {
            autoindex on;
    }

Best Answer

Unless you make a configuration error (now or in the future), the directory index will never be exposed by nginx. You must explicitly enable directory autoindexing for directories. The next snippet enables auto-indexing for all subdirectories under /public/ (excluding /public):

server {
    // server_name, logs, redirect, etc.
    location ~ /public/.+/ {
        autoindex on;
    }
}

The index directive takes precedence over the autoindex one, that is, if an index file is found, the directory won't show an autoindex. If you trust yourself never to remove the topmost index file, you can remove the autoindex directive.

Related Topic