1

In my apache server I don't want to serve any files with extensions .config because it could contain potentially sensitive information. In my apache2.conf file I added:

<FilesMatch "\.config">
    Require all denied
</FilesMatch>

Then I restarted Apache and tested. It works. Almost. None of the files db.config, redirect.config, UrlTypes.config or hidden.config are served, which was the point BUT, one file named web.config is served (it lies in the same directory as the others). Why, and what is so special with web.config that doesn't follow the indications?

  • Nothing is special about web.config on Apache. (It's the main server config file on IIS - but that should be irrelevant here.) You may have a conflict with some other directive that is allowing access, or you are seeing a cached response? Incidentally, the regex \.config matches ".config" anywhere in the file basename, not just files that end ".config". – MrWhite Dec 11 '18 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.