httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Joshua Slive" <>
Subject Re: [users@httpd] changing the error status code for forbidden resources
Date Wed, 23 May 2007 00:28:21 GMT
On 5/22/07, Bhagwati Gupta <> wrote:
> Hi,
>     I am running Apache 2.2.3 on my Debian 3.1 sarge machine. My local
> web security team has examined the system and generated a detailed
> security report. One of the issues that I am having difficulty to fix
> relates to hidden directories. I have been advised to change the server
> configuration such that '404 - not found' response is issued for
> forbidden resources as opposed to '403 - forbidden' response. I have
> tried looking on the web but have yet to find anything that could solve
> my problem. I am not sure exactly how server responses for hidden
> directories (or missing files) can be customized. Could you please help?
> Thanks!

Sounds like a silly waste of time to me. (Actually, it's more than a
waste of time, it is deliberately crippling of HTTP.)

But anyway, if you want to lie about error codes, you can go all the
way and change the to redirects:

ErrorDocument 404
ErrorDocument 403

If you just want to lie about 403 only, then the only way I know
(other than editing the code)  is to point to a cgi script that emits
its own "Status: 404" header:
ErrorDocument 403 /cgi-bin/


The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:> for more info.
To unsubscribe, e-mail:
   "   from the digest:
For additional commands, e-mail:

View raw message