Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Apache/2.2.21 (Debian) webserver, which I disabled directory listing with Options -Indexes but now I got 404 error for a directory, but I think I should get a 403.

I have no idea why I get 404, rather than 403. What should I check?

I have disabled autoindex module, after it I got a 404 for every URL that request a directory listing (eg: www.somesite.com/dir ). How can I get a 403 for this. (The dir does exist)

As a try I also put Options -Index in the end of main config file (apache2.conf).

share|improve this question
    
What makes you think that a 403 is the correct response? The directory exists, but there's no web-accessible resource at the location - 404 is the proper response code. –  Shane Madden Nov 15 '11 at 16:14
    
Not necessarily; with -Indexes, its not that there's no resource--its that there's a resource that the user does not have access to. –  Andrew M. Nov 15 '11 at 19:51
add comment

2 Answers 2

I had exactly the same problem and I found that the solution is as simple as:

  1. ENABLE mod_autoindex, otherwise you'll never get 403 for directory requests
  2. DISABLE Indexes in directory's Options setting for obvious reason
share|improve this answer
add comment

If you redefined Error 403 to missing resource, you'll get exactly this result Check accesslog for requested URL

share|improve this answer
    
In the log I see 404 error. –  netmano Nov 15 '11 at 20:04
    
Check accesslog for requested URL –  Lazy Badger Nov 15 '11 at 20:16
    
The dir 2010 is exists on the site, and the following in the custom log: xxx.xxx.xxx.xxx - - [16/Nov/2011:11:02:49 +0100] "GET /2010 HTTP/1.1" 301 545 "-" "CUT:browserinfo" xxx.xxx.xxx.xxx - - [16/Nov/2011:11:02:49 +0100] "GET /2010/ HTTP/1.1" 404 316 "-" "CUT:browserinfo" –  netmano Nov 16 '11 at 10:04
    
301 status code in first answer means "for some reason redirect fired" obviously, and for redirect target (which doesn't exist) you get 404. At least I see it this way. Check httpd.conf or .htaccess for defined redirects –  Lazy Badger Nov 18 '11 at 13:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.