Content of a web-directory

Question

I've got a site with some administrative pages in its root directory. Question: Is there any possible way for a visitor to see all the pages and/or subdirectories in the root directory of this (or any other) site?

If yes, what has to be done to conceal the directory's content?

Thank you!

Answer 1

You can set this permission in the web server. For IIS there is a enable directory browsing property that can be set on website, virtual directories and applications.

For Apache:

In httpd.conf search for Options, if Indexes is present Directory browsing is enabled else it is disabled Options All Indexes FollowSymLinks MultiViews (Directory browsing Enabled) Options All FollowSymLinks MultiViews (Directory browsing Disabled)

Answer 2

It depends on what server you are using. For example, for jetty, you can use a context file (in xml) to conceal/hide a directory's content...

<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure.dtd"&gt;

<Configure class="org.eclipse.jetty.server.handler.ContextHandler">
    <Call class="org.eclipse.jetty.util.log.Log" name="debug">
        <Arg>Configure sarbot_files.xml</Arg>
    </Call>
    <Set name="contextPath">/some_context</Set>
    <Set name="resourceBase">/path/to/files</Set>
    <Set name="handler">
        <New class="org.eclipse.jetty.server.handler.ResourceHandler">
        <!-- Set to true or false here -->
            <Set name="directoriesListed">true</Set>
            <Set name="welcomeFiles">
                <Array type="String">
                    <Item>index.html</Item>
                </Array>
            </Set>
            <Set name="cacheControl">max-age=3600,public</Set>
        </New>
    </Set>
</Configure>