Sunday 3 April 2016

Disabling the Directory Browsing in WebServer

In most of the Web servers Directory browsing is enabled by default.

to secure the code from Directory Browsing we need to disable the Directory Browsing using the below steps.

Before directory Browsing Disabled

Alias "/test/" "/testMachine/folder1/"

Directory "/testMachine/folder1/">
Options Indexes MultiViews
AllowOverride None
Order allow,deny
Allow from all
</Directory>

In Web Server httpd.conf find the above lines and replace Indexes with --Indexes.after making the changes code in httpd.conf file looks like below

After directory Browsing Disabled

Alias "/test/" "/testMachine/folder1/"

Directory "/testMachine/folder1/">
Options -Indexes MultiViews
AllowOverride None
Order allow,deny
Allow from all
</Directory>

Ensure you have restarted webservers to reflect the changes. before verifying clear browser cookies.

Note: in Few Apache based websevers even we can remove the word Indexes will also gives the same directory disabled behaviour.
to reflect the Directory browsing use correct webserver conf file and correct application accessible directory as mentioned above if you have mulplte applications configured in your webservers.