Apache Cookbook, 2nd Edition

13.9. Directory Listings in ScriptAliased Directories

Problem

You want to allow directory indexing in a directory named in a ScriptAlias directive.

Warning

This is considered a bad idea because it can reveal to strangers the names of specific scripts that may be subvertible.

Solution

Add the following lines to the <Directory> container that defines the characteristics of your ScriptAliased directory:

    <Files ".">
        Options Indexes FollowSymLinks
        SetHandler httpd/unix-directory
    </Files>

Discussion

The ScriptAlias directive imposes a lot of restrictions on directories to which it is applied, primarily for reasons of security. After all, such directories contain scripts of arbitrary code that will be executed on your system; if you should happen to be using a well-known and popular script in which a vulnerability is subsequently detected, anyone on the Web may be able to take advantage of it.

One of the restrictions imposed explicitly by design is disallowing directory listings in ScriptAliased parts of the filesystem. This amounts to what’s called “security through obscurity”—namely, hiding an issue and hoping that no one discovers it even though it’s easily accessible—but it’s better than advertising what scripts your server can execute.

However, under some circumstances you may want to allow directory listings in such directories—or at least the use of pseudolistings provided by files named in a DirectoryIndex directive. To do this you need to override the special protections. In particular, ...