Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On my webserver I would like to block all files except some reasonable exceptions. I have following Filesmatch directive which is doing it's work:

<FilesMatch "(?<!\.txt|\.htm|\.html|\.css|\.php|\.js|\.jpg|\.png|\.gif|\.ico|\.svg|\.eot|\.ttf|\.woff|\.otf)$">
    Order Allow,Deny
    Deny from All
</FilesMatch>

Note this FilesMatch uses a negative lookbehind regular expression: see http://www.regular-expressions.info/lookaround.html. It will block all files except those having an extension as stated.

This results also in an 403 Forbidden for the directory default document (index.html). This is not what I want. Can someone help? How does the default document lookup work? Is there another solution to blocking all except some? I looked in Apache2's error log with LogLevel debug, but the only message is "client denied by server configuration" when asking for a default document. (Explicitly asking for the index.html works)

Edit: there is a solution to this by using the Location directive. See Using FilesMatch to increase security So my problem is solved, but I still would like to know why it does not work with FilesMatch.

share|improve this question
    
Why do you expect .html not to block index.html ? –  gparent May 20 '13 at 19:40
    
Why do you have files in that directory, if you don't want people to be able to get them?? –  Chris S May 20 '13 at 19:41
    
I added some info: the filesmatch directive here is not blocking files ending on .html. And the intention is indeed to show the files with extensions specified, nothing else. –  user906489 May 20 '13 at 19:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.