I am trying to prevent access to my web site except for access to the single URL "/ws/public" that everyone is allowed to view. I am running Apache WebServer in front of an Apache Tomcat which is serving up the content from a Java Web Application via a Web Service.

I have a single configuration file for Apache WebServer which looks like the following:

<VirtualHost *:80>
    ServerName foo.org
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    ProxyPass        /VS/ws/public http://localhost:8090/VS/ws/public
    ProxyPassReverse /VS/ws/public http://localhost:8090/VS/ws/public

This looks correct to me. I have tested accessing the private Web Service and other pages and I always get a 404. This is ok.

A colleague suggested that requests including ".." such as http://mysite/VS/ws/public/../private would allow access to the private Web Service, but in my testing I could not achieve this (I do not want this!)

So, is the above configuration correct to only allow access to http://mysite/VS/ws/public ? Are there any security issues that I have overlooked?


In your MAIN apache2.conf (or a .conf file that gets included in your main configuration file), you should have a directory that sets the default to deny access to ALL parts of your server:

<Directory "/">
  Require all denied

THEN, inside your <VirtualHost *:80> block, you should include an access control to allow access only to the document root:

<Directory "/var/www/html">
  Require all granted

Without this, your colleague is correct that there is a vulnerability in the server setup.

ALTERNATIVELY: If you really ONLY want access to http://mysite/VS/ws/public, you can use the <Location> containers:

<Location "/">
  Require all denied

<Location "/VS/ws/public">
  Require all granted

in the <VirtualHost *:80> block.

NOTE: A 404 error merely indicates that the sought file "was not found" on the server. You will get a 403 error if the sought file was "denied by server configuration." In other words, your test result DOES NOT indicate any application or level of security.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.