1

On a Debian VPS I run an Apache 2.4.56 web server and I want to prevent any access to a parent URL, for instance

https://example.com/participants

while allowing access to any of its children, for instance

https://example.com/participants/joebloggs

https://example.com/participants/janedoe

https://example.com/participants/johndoe

The parent URL I want to block is a db-generated page that shows a listing of all the users. I do not want to serve this page, only its children.


I tried the following in my apache2.conf

<Location /participants>
   Order Allow,Deny
</Location>
<Location /participants/*>
   Order Deny,Allow
</Location> 

and

<Location /participants/>
        Options None
        AllowOverride None
        Require all denied
</Location>

<LocationMatch /participants/*>
        Require all granted
</LocationMatch> 

but both sets of directives return 301 - Forbidden for both parent and children URLs.

What's the right approach?

4
  • What powers the contents of /participants? Is it a directory listing? Is it an directory index file (index.html)? Is there a rewrite rule that passed it to some code? Sep 28, 2023 at 11:58
  • @StephenOstermiller if by 'directory' you mean an actual directory then no. participants is a db-generated page that shows a listing of all the users, which I do not want to serve. Does that answer your question? P.S. updated my OP with what you were asking.
    – Dave White
    Sep 28, 2023 at 14:02
  • It might be easier to modify the code to throw an exception rather than generate that page. Sep 28, 2023 at 14:18
  • @StephenOstermiller Site is in PHP. You mean change the PHP code? I did that already, but I thought blocking it at Apache level would be better. It seems that Googlebot was still picking up users that have no way of being indexed as they have no material published. Anyway, in the meantime I tried a directive that seems to work.
    – Dave White
    Sep 28, 2023 at 15:32

1 Answer 1

0

These directives seem to do the job

<LocationMatch "^/participants/$">
    Require all denied
</LocationMatch>

<LocationMatch "^/participants/[^/]+$">
    Require all granted
</LocationMatch>
2
  • I'll bet you don't need the second directive. In fact, it could interefere with some other directive that requires password, or blocks access to something in that directory. Sep 28, 2023 at 17:07
  • @StephenOstermiller thx... I will test it without
    – Dave White
    Sep 28, 2023 at 17:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.