# How to not 'expose' directory tree by default

**URL:** <https://www.ruby-forum.com/t/how-to-not-expose-directory-tree-by-default/229338>\
**Category:** NGINX\
**Created:** [January 18, 2013, 1:22pm UTC](https://www.ruby-forum.com/t/how-to-not-expose-directory-tree-by-default/229338 "2013-01-18T13:22:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jan-Philip\_Gehrcke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/54ee81/32.png) [@Jan-Philip\_Gehrcke](https://www.ruby-forum.com/u/Jan-Philip_Gehrcke)\
**Post date:** [January 18, 2013, 1:22pm UTC](https://www.ruby-forum.com/t/how-to-not-expose-directory-tree-by-default/229338/1 "2013-01-18T13:22:23Z")

</div>

Hello,

error 403 means that the location exists and access is not allowed while  
404 means that the location does not exist.

Based on this, with mostly default settings, it is (in theory) possible  
to determine the directory structure below the document root via  
guessing or dictionary attack. This may or may not be considered a  
security risk (what do you think?).

I know that there are ways to make nginx return 404 for specific  
locations, including directories. In am wondering, however, if there is  
a neat approach making nginx return 404 generally for each directory  
that

- has not explicitly enabled autoindex and
- contains no ‘index’ file (HttpIndexModule)

Thanks,

Jan-Philip

---

<div class="post-metadata">

**Author:** ![Jan-Philip\_Gehrcke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/54ee81/32.png) [@Jan-Philip\_Gehrcke](https://www.ruby-forum.com/u/Jan-Philip_Gehrcke)\
**Post date:** [January 21, 2013, 1:55am UTC](https://www.ruby-forum.com/t/how-to-not-expose-directory-tree-by-default/229338/2 "2013-01-21T01:55:58Z")

</div>

Hello!

On Fri, Jan 18, 2013 at 01:21:44PM +0100, Jan-Philip Gehrcke wrote:

> Hello,
> 
> error 403 means that the location exists and access is not allowed  
> while 404 means that the location does not exist.
> 
> Based on this, with mostly default settings, it is (in theory)  
> possible to determine the directory structure below the document  
> root via guessing or dictionary attack. This may or may not be  
> considered a security risk (what do you think?).

It is always possible to determine all files available under  
document root as long as you have enough time or luck.  
Directories are just special case of files which return directory  
listing if they are requested with traling slash and listing is  
allowed.

> I know that there are ways to make nginx return 404 for specific  
> locations, including directories. In am wondering, however, if there  
> is a neat approach making nginx return 404 generally for each  
> directory that
> 
> - has not explicitly enabled autoindex and
> - contains no ‘index’ file (HttpIndexModule)

Simple solution would be to redefine 403 to be 404, something like

```
error_page 404 = /error/403;

location = /error/403 {
    return 404;
}

```

Note though, that it will be still possible to find out there is a  
directory, as on request without trailing slash a 301 redirect will  
be returned with trailing slash added. (You may use similar  
aproach to override 301 redirects as well, but it will as well  
affect directories with autoindex enabled/index files present,  
resulting in bad user experience.)

–  
Maxim D.

> **[F5 NGINX: Built for cloud-native apps. Ready for AI traffic.](https://www.f5.com/products/nginx)**
>
> Deliver modern applications with NGINX. Explore high-performance load balancing, API gateways, and web server solutions trusted by top global enterprises.