Prevent accidental directory listings in Nginx

403 Forbidden: directory listing still visible after autoindex off

0 reputation · 04 Jun 2023, 21:00 UTC

58.3K views0

Goal

Prevent accidental exposure of file listings in an Nginx deployment by ensuring autoindex off is respected across all relevant contexts.

Constraints & Uncertainty

Documentation states that autoindex off disables directory listings, yet users occasionally observe a 403 Forbidden page that still displays a file list. Possible causes include nested location blocks overriding the directive, server-wide defaults, or mis‑placement of the directive within a server context.

Questions

Under what circumstances can a nested location block re‑enable directory listing even when autoindex off is set at the server level?
Is there a documented method to enforce autoindex off globally across all sub‑directories without modifying every individual location block?

Keep exploring this topic

Invalid hostname provided to Image component in next/image configuration

Investigate the transition from images.domains to remotePatterns in Next.js to resolve hostname rejection errors.

NodeIntegration default false limits Node API usage in windows

Exploring the unresolved decision to keep nodeIntegration disabled by default in NodeWebKit, its security implications, and rollback options after schema changes.

Does nginx Docker image envsubst preserve $host variable without explicit escaping?

Investigating whether the official nginx Docker image's envsubst templating preserves nginx variables like $host without manual escaping, and how NGINX_ENVSUBST_FILTER interacts with them across image versions.

Electron nodeIntegration default and accidental public access risk

Electron 12+ disables nodeIntegration in renderers by default, but legacy apps still enable it. The lack of warnings creates accidental exposure risk. What are the consequences of changing the default, how to detect accidental enablement, and can tooling help prevent public access?

403 Forbidden: directory listing still visible after autoindex off

Goal

Constraints & Uncertainty

Questions

0 answers

Your perspective belongs here.

0 question comments