Apache: security difference between folder in web root and alias?

Question

When serving a site with Apache, there are two ways that I know of placing some content at "servername/foo":

1. Place it in the web root under a folder called 'foo'
2. Create an alias

As an example of #2, XAMPP has these statements in a config file:

Alias /phpmyadmin "C:/xampp/phpMyAdmin/"

<Directory "C:/xampp/phpMyAdmin">
   AllowOverride AuthConfig
   Order allow,deny
   Allow from all
</Directory>

...Which means "if the server is localhost, and somebody visits localhost/phpmyadmin, show them the contents of C:/xampp/phpMyAdmin, given the following permissions."

In this example, given that phpMyAdmin is accessible from the same URL, does it matter from a security perspective whether it's in the web root folder or just aliased to look as though it were?

Answer 1

For "regular" (static) apache and if you narrow the example down to a tight 1:1 scenario: No, it does not matter. Hypothetically if you mix and mash and lose track of what permissions are inherited where, you could maybe expose something you didn't mean to.

I think most importantly it does make it easier for a distinct code branch to be owned (and possibly therefore written to) by a separate user than the one you use for your webserver and document root. This is needed for reliable packaging, and reliable packaging is a core part of long term security.

Also keep in mind that apache modules can be pretty dang flexible. So while the core apache stuff won't behave any differently, third party authentication modules or even php settings like open_basedir and include_path can vary behavior.

Answer 2

No.

The Directory statement applies to a DIRECTORY. It does not matter where in the system this directory exists.

Note the the indent on your question implies some sort of relationship between the Alias and Directory lines, which isn't really there.