2

at "webmasters.stackexchange.com" I already found a similar topic: Stop directory listing using .htaccess and redirect to good error page

Options -Indexes
ErrorDocument 403 /path/to/403.html

However, now I want to distinguish between whether there was actaully a directory listing request issued OR if the user tried to access a protected area (through htaccess) unsuccessfully.

Both fire a 403, now how do I know which was the reason (the directory listing or the htaccess AuthName... thing) ?

2
  • I am not sure you can without mod_perl. I can't think of anything yet.
    – closetnoc
    Apr 18, 2014 at 15:44
  • What do you want to do if it was a directory request OR protected area? Any reason why you can't check this in your 403 document itself?
    – MrWhite
    Apr 18, 2014 at 17:00

2 Answers 2

1

A request for a directory listing will have a URL that ends in /.

So http://example.com/images/ will be a 403 because of the directory listing.

http://example.com/private/document.html will be a 403 because of your rule for the private directory.

1
  • Unfortunately, this won't work with my situation as I have a folder called like "private" that is protected but there is an index file in there, so requesting that file could be done via "example.com/private" which has a trailing slash NOT because of the directory listing but because of the .htaccess protection.
    – user37181
    Apr 20, 2014 at 14:32
1

Finally it worked by putting an additional line in the .htacces of the protected folder (call it private)

ErrorDocument 403 /forbidden-because-of-protection

and in the root's .htaccess I put the line like

ErrorDocument 403 /forbidden-because-of-directory-listing

So now when there is some request issued like /private/some/thing/bla the first .htaccess rule will be called - thus redirecting to /forbidden-because-of-protection otherwise like requesting a directory listing (thus not in /private) apache goes for the second rule.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.