I have an Apache/2.2.21 (Debian) webserver, which I disabled directory listing with Options -Indexes but now I got 404 error for a directory, but I think I should get a 403.

I have no idea why I get 404, rather than 403. What should I check?

I have disabled autoindex module, after it I got a 404 for every URL that request a directory listing (eg: www.somesite.com/dir ). How can I get a 403 for this. (The dir does exist)

As a try I also put Options -Index in the end of main config file (apache2.conf).

  • What makes you think that a 403 is the correct response? The directory exists, but there's no web-accessible resource at the location - 404 is the proper response code. – Shane Madden Nov 15 '11 at 16:14
  • Not necessarily; with -Indexes, its not that there's no resource--its that there's a resource that the user does not have access to. – Andrew M. Nov 15 '11 at 19:51

I had exactly the same problem and I found that the solution is as simple as:

  1. ENABLE mod_autoindex, otherwise you'll never get 403 for directory requests
  2. DISABLE Indexes in directory's Options setting for obvious reason
| improve this answer | |

If you redefined Error 403 to missing resource, you'll get exactly this result Check accesslog for requested URL

| improve this answer | |
  • In the log I see 404 error. – netmano Nov 15 '11 at 20:04
  • Check accesslog for requested URL – Lazy Badger Nov 15 '11 at 20:16
  • The dir 2010 is exists on the site, and the following in the custom log: xxx.xxx.xxx.xxx - - [16/Nov/2011:11:02:49 +0100] "GET /2010 HTTP/1.1" 301 545 "-" "CUT:browserinfo" xxx.xxx.xxx.xxx - - [16/Nov/2011:11:02:49 +0100] "GET /2010/ HTTP/1.1" 404 316 "-" "CUT:browserinfo" – netmano Nov 16 '11 at 10:04
  • 301 status code in first answer means "for some reason redirect fired" obviously, and for redirect target (which doesn't exist) you get 404. At least I see it this way. Check httpd.conf or .htaccess for defined redirects – Lazy Badger Nov 18 '11 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.