Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When serving a site with Apache, there are two ways that I know of placing some content at "servername/foo":

  1. Place it in the web root under a folder called 'foo'
  2. Create an alias

As an example of #2, XAMPP has these statements in a config file:

Alias /phpmyadmin "C:/xampp/phpMyAdmin/"

<Directory "C:/xampp/phpMyAdmin">
   AllowOverride AuthConfig
   Order allow,deny
   Allow from all

...Which means "if the server is localhost, and somebody visits localhost/phpmyadmin, show them the contents of C:/xampp/phpMyAdmin, given the following permissions."

In this example, given that phpMyAdmin is accessible from the same URL, does it matter from a security perspective whether it's in the web root folder or just aliased to look as though it were?

share|improve this question
I have not yet learned mod_rewrite. I gather that it could be #3 on this list, but is considerably more complex. – Nathan Long Jan 19 '10 at 22:46
up vote 2 down vote accepted

For "regular" (static) apache and if you narrow the example down to a tight 1:1 scenario: No, it does not matter. Hypothetically if you mix and mash and lose track of what permissions are inherited where, you could maybe expose something you didn't mean to.

I think most importantly it does make it easier for a distinct code branch to be owned (and possibly therefore written to) by a separate user than the one you use for your webserver and document root. This is needed for reliable packaging, and reliable packaging is a core part of long term security.

Also keep in mind that apache modules can be pretty dang flexible. So while the core apache stuff won't behave any differently, third party authentication modules or even php settings like open_basedir and include_path can vary behavior.

share|improve this answer
I'll add that I find it easier to control permissions with Directory & Alias rather than using Location (and potentially missing symbolic links that make 2 Locations point to the same Directory). From a security standpoint I would prefer <Directory> restrictions. – voretaq7 Jan 28 '10 at 21:11


The Directory statement applies to a DIRECTORY. It does not matter where in the system this directory exists.

Note the the indent on your question implies some sort of relationship between the Alias and Directory lines, which isn't really there.

share|improve this answer
Thanks - I edited the question accordingly. – Nathan Long Jan 19 '10 at 23:01
Probably should put the directory permissions example back, just don't indent it to look like it's a child of the alias line. :) – Michael Graff Jan 19 '10 at 23:04
OK - done. Thanks. – Nathan Long Jan 20 '10 at 11:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.