0

I'm deploying some sort of file exchange based on the assumption that the files are accessible only to the person which knows the folder path on the server (ex. mydomain.tld/privatesecretfolder/). I've enabled the autoindex feature in Nginx and created a dummy index.html file inside the document root.

Now my question: is it possible for someone to generate a directory index (with full view of the supersecretfolders) even when index.html is present?

Just as a reference the section which enables autoindexes:

    location ~/ {
            autoindex on;
    }
|improve this question
  • Why don't you add some kind of real authentification? I mean this is just security by (not really existing) obscurity. - Browserlogs just to mention... – Simon Strasser Jan 2 '13 at 20:26
  • Well it's not meant to exchange sensitive data, just to provide minimal privacy to avoid that the whole internet gets the content. Managing authentication and authorization is overkill for what I'm doing, so my only way is to use "obscure" methods :) – Martino Dino Jan 2 '13 at 20:42
  • Well after all I would really advise you to look at this document: wiki.nginx.org/HttpAuthBasicModule - Really simple, isn't it? – Simon Strasser Jan 2 '13 at 20:45
  • Thx for the link, but I already knew how to manage basic HTTP auth, the reason I don't want to use that is because this site will be used by a professional photographer to send pictures to his customers, he is barely able to upload the pictures via sFTP, asking him to keep track of usernames/passwords would be almost impossible. – Martino Dino Jan 2 '13 at 23:05
  • I'm a bit confused; Do the customers need each their own directory index of does just the administrator need one? Because if the first, you might as well enable normal autoindex and just make sure the folder names are random. If the second, just enable autoindex but protect the index/dirlist pages with a password. – Sašo Jan 6 '13 at 21:18
1

Unless you make a configuration error (now or in the future), the directory index will never be exposed by nginx. You must explicitly enable directory autoindexing for directories. The next snippet enables auto-indexing for all subdirectories under /public/ (excluding /public):

server {
    // server_name, logs, redirect, etc.
    location ~ /public/.+/ {
        autoindex on;
    }
}

The index directive takes precedence over the autoindex one, that is, if an index file is found, the directory won't show an autoindex. If you trust yourself never to remove the topmost index file, you can remove the autoindex directive.

|improve this answer

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.