Archive - Originally posted on "The Horse's Mouth" - 2008-05-08 17:01:07 - Graham Ellis
The Web Server Administrator has two choices as to what he / she should do when a content provider doesn't supply a home page (index.html or similar) in a directory - either he can generate an error such as a 403 ("Forbidden") or 404 ("Not found"), or he can generate a directory listing, so that the web site visitor can access the content of the directory anyway.
Question - How does the web site admin turn directory listing on and off?
The Web Server configuration file is usually called httpd.conf, though were you find it varies depending on your operating system and configuration. For a web server installed on a Linux server, as configured on our Linux Web Server and Deploying Apache httpd and Tomcat courses, you'll be looking at /usr/local/apache2/conf.
Find the Options line for the directory in which the directory tree you're interesting in altering is located and add (or remove) Indexes. For example:
Yes, if given such permission by the Web Site Admin. The Web Site Admin need to allow overrides - if the httpd.conf file says
AllowOverride None
then the web developer has no control but it it says either of
AllowOverride Options
or AllowOverride All
the it CAN be overridden by the web developer ... who would provide a file called .htaccess in the top level directory to which the automatic indeing should apply. The line in that file would be either
Options Indexes
to allow Indexes (only) or
Options +Indexes
To turn indexes on in addition to options inherited from the directory above.
There may be other things in the .htaccess file too, and these files can exist in multiple places on the web site - here's an example of mine that allows a directory listing and turn off any page rewrites too:
RewriteEngine Off
Options Indexes
and here's one which (by contrast) diverts all .html and .htm requests to a script with the undescriptive name 8.php, passing in the name of the page that was called up as a parameter.
RewriteEngine On
RewriteRule ^(.*)\.htm 8.php?pagename=index&sharename=&%{QUERY_STRING}
Question - is it a good idea to allow automatic indexes?
In general NO. If you leave out the home page from a directory by mistake, you'll be exposing yourself to anyone who visits your web site. When I go to a web site following a link to an obscure page on a domain I don't know, I often "research" the domain by cutting sections off the path. By disallowing, you stop people like me spying around, and perhaps finding backup files (e.g. copies of .php scripts that have a .bak extension) from which I could (but wouldn't!) break holes in your site.
But if you want to make a directory from which people can quickly and easily grab pictures and you're not too worried about it looking pretty, then in these LIMITED CIRCUMSTANCES it can be a good idea.
In fact I have turned in on for one of my directories today - here where you can some some record shots of this morning's breakfast setup, and of Devizes last night.
Note - than answers on this page apply to the Apache httpd web server, which is used to serve the majority of domains on the web. Options and configuration files differ for other servers.