# Confused with hiding a directory

**URL:** <https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673>\
**Category:** NGINX\
**Created:** [August 3, 2010, 8:55pm UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673 "2010-08-03T20:55:24Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [August 3, 2010, 8:55pm UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/1 "2010-08-03T20:55:24Z")

</div>

Let’s say I have a directory named conf in the root of my website I want  
to hide. From what I understood, if I have

`
  location /conf {
    deny all;
  }`  
It will not allow anybody to see what is inside /conf. But, what if I do  
not want people even to know that /conf is there to begin with, while  
other files and directories are visible?

Posted at Nginx Forum:

> **[confused with hiding a directory](https://forum.nginx.org/read.php?2,116233,116233#msg-116233)**
>
> Let's say I have a directory named conf in the root of my website I want to hide. From what I understood, if I have \[code\] location /conf { deny all; }\[/code\] It will not allow anybody to see what is inside /conf. But, what if I do not want people...

---

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [August 3, 2010, 9:00pm UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/2 "2010-08-03T21:00:41Z")

</div>

On Tue, Aug 03, 2010 at 02:54:53PM -0400, raubvogel wrote:

> Let’s say I have a directory named conf in the root of my website I want  
> to hide. From what I understood, if I have
> 
> `
> location /conf { 
> deny all;
> }`  
> It will not allow anybody to see what is inside /conf. But, what if I do  
> not want people even to know that /conf is there to begin with, while  
> other files and directories are visible?

```
location /conf {
    internal;
}

```

nginx will return 404 as location does not exist.

–  
éÇÏÒØ óÙÓÏÅ×  
[http://sysoev.ru](http://sysoev.ru)

---

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [August 3, 2010, 9:14pm UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/3 "2010-08-03T21:14:09Z")

</div>

Thanks for the suggestion. Unfortunately the directory conf is still  
being shown. Once I click on it, I get the 404 error. Here is the conf  
file for the site, just in case I have done something somewhere else  
that is affecting this (nginx.conf has not being touched):

[code]  
server {  
listen 80 default;

# Default site

server\_name \_;  
autoindex on;

access\_log /var/log/nginx/packages-error.log;  
error\_log /var/log/nginx/packages-error.log;

location / {  
root /export/www/site1;  
}

location /conf {  
internal;  
}

location ~ /(.\*)/db {  
deny all;  
}  
}[/code]

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,116233,116241#msg-116241](http://forum.nginx.org/read.php?2,116233,116241#msg-116241)

---

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [August 3, 2010, 9:15pm UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/4 "2010-08-03T21:15:19Z")

</div>

2010/8/3 Igor S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> > other files and directories are visible?
> 
> location /conf {  
> internal;  
> }
> 
> nginx will return 404 as location does not exist.

Hi,

Sometime ago I made a patch to add a “hidden” keyword.  
A hidden location is reachable only from on internal request  
(subrequest, rewrite), but won’t return a 404 if a front facing client  
hits this location, instead they would get the last public location in  
the tree. ( / instead of /conf for example).

This is useful if you need internal mechanisms, but redirect most of  
your traffic using a proxy\_pass, and can’t make assumption about the  
locations about the upstream you proxy.  
If you’re interested I can update the patch for nginx 0.8.48.

–  
Matthieu T.

---

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [August 3, 2010, 10:02pm UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/5 "2010-08-03T22:02:45Z")

</div>

On Tue, Aug 03, 2010 at 12:13:55PM -0700, Matthieu T. wrote:

> > > not want people even to know that /conf is there to begin with, while
> 
> Sometime ago I made a patch to add a “hidden” keyword.  
> A hidden location is reachable only from on internal request  
> (subrequest, rewrite), but won’t return a 404 if a front facing client  
> hits this location, instead they would get the last public location in  
> the tree. ( / instead of /conf for example).
> 
> This is useful if you need internal mechanisms, but redirect most of  
> your traffic using a proxy\_pass, and can’t make assumption about the  
> locations about the upstream you proxy.  
> If you’re interested I can update the patch for nginx 0.8.48.

```
location /conf {
    internal;
    error_page 404 = /;
}

```

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [August 3, 2010, 9:39pm UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/6 "2010-08-03T21:39:20Z")

</div>

I would really appreciate if you could update this patch; it sure sounds  
like exactly what I need.

Thanks!

Posted at Nginx Forum:

> **[Re: confused with hiding a directory](https://forum.nginx.org/read.php?2,116233,116255#msg-116255)**
>
> Let's say I have a directory named conf in the root of my website I want to hide. From what I understood, if I have \[code\] location /conf { deny all; }\[/code\] It will not allow anybody to see what is inside /conf. But, what if I do not want people...

---

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [August 3, 2010, 10:05pm UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/7 "2010-08-03T22:05:06Z")

</div>

On Tue, Aug 03, 2010 at 03:13:02PM -0400, raubvogel wrote:

> Thanks for the suggestion. Unfortunately the directory conf is still  
> being shown. Once I click on it, I get the 404 error. Here is the conf

Well, what should nginx return for this location ?  
Also, what should nginx return for any non-existant file/directory ?  
404 means that there is no such file/dirctory on site.

> error\_log /var/log/nginx/packages-error.log;  
> deny all;  
> }  
> }[/code]

–  
Igor S.

> **[Igor Sysoev](http://sysoev.ru/en/)**

---

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [September 13, 2010, 12:08am UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/8 "2010-09-13T00:08:39Z")

</div>

Sorry for taking so long; I had to put that server into production. So I  
built another (the first one is an ubuntu one), applied your patch to  
nginx-0.8.50 (it did not bark), and compiled it. So, I set the conf dir  
as

```auto
location /conf {
            hidden;
        }
```

and restarted nginx. Unfortunately I can still see the directory. Did I  
miss anything?

Posted at Nginx Forum:

> **[Re: confused with hiding a directory](https://forum.nginx.org/read.php?2,116233,129833#msg-129833)**
>
> Let's say I have a directory named conf in the root of my website I want to hide. From what I understood, if I have \[code\] location /conf { deny all; }\[/code\] It will not allow anybody to see what is inside /conf. But, what if I do not want people...

---

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [August 3, 2010, 10:49pm UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/9 "2010-08-03T22:49:36Z")

</div>

On Tue, Aug 3, 2010 at 12:38 PM, raubvogel [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I would really appreciate if you could update this patch; it sure sounds  
> like exactly what I need.
> 
> Thanks!

This patch should work with nginx-0.8.42 and above, I just tried and  
it seems to work with 0.8.48.  
To apply it :  
patch -p1 \< nginx-0.8.42\_hidden-location.patch

Let me know if you have any trouble with it.

---

<div class="post-metadata">

**Author:** ![raubvogel](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/ce73a5/32.png) [@raubvogel](https://www.ruby-forum.com/u/raubvogel)\
**Post date:** [September 14, 2010, 1:40am UTC](https://www.ruby-forum.com/t/confused-with-hiding-a-directory/192673/10 "2010-09-14T01:40:41Z")

</div>

On Sun, Sep 12, 2010 at 3:07 PM, raubvogel [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> and restarted nginx. Unfortunately I can still see the directory. Did I  
> miss anything?

Hi,

If you have something like :

http {  
location / {  
proxy\_pass [http://backend](http://backend);  
}

location /conf {  
hidden;  
  
}  
}

if you request for /conf externally you should hit  
http:///conf via the proxy\_pass. The nginx /conf is  
accessible only from a subrequest.  
Is it what you’re trying to achieve, or do you have a different scenario  
?

Matthieu.

–  
Matthieu T.