Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (herse.apache.org: domain of jslive@gmail.com designates
 64.233.184.236 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=gYHV830EyGgWI1FMXhX7yWBKpOB/fzOoJeUNMG8iOFthQ3etFvAgtKxfOZnMTrBc3GIVMmzMJ0zoW6kfVJS/kky3j2xEWjUpA8NAmdb9uKFYQfMCKWpXetrpJ2NRKJ/ARdb1aNft2E/pxRDskp1yVKU2FDvldYGC6eFHvSqevhE=
Message-ID: <e498c1660705221728g2e8a4a5agd133b51b1b127586@mail.gmail.com>
Date: Tue, 22 May 2007 20:28:21 -0400
From: "Joshua Slive" <joshua@slive.ca>
Sender: jslive@gmail.com
To: users@httpd.apache.org
In-Reply-To: <465358AB.6060703@yahoo.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <465358AB.6060703@yahoo.com>
Subject: Re: [users@httpd] changing the error status code for forbidden
 resources

On 5/22/07, Bhagwati Gupta <bpg10000@yahoo.com> wrote:
> Hi,
>     I am running Apache 2.2.3 on my Debian 3.1 sarge machine. My local
> web security team has examined the system and generated a detailed
> security report. One of the issues that I am having difficulty to fix
> relates to hidden directories. I have been advised to change the server
> configuration such that '404 - not found' response is issued for
> forbidden resources as opposed to '403 - forbidden' response. I have
> tried looking on the web but have yet to find anything that could solve
> my problem. I am not sure exactly how server responses for hidden
> directories (or missing files) can be customized. Could you please help?
> Thanks!

Sounds like a silly waste of time to me. (Actually, it's more than a
waste of time, it is deliberately crippling of HTTP.)

But anyway, if you want to lie about error codes, you can go all the
way and change the to redirects:

ErrorDocument 404 http://example.com/not_found.html
ErrorDocument 403 http://example.com/not_found.html

If you just want to lie about 403 only, then the only way I know
(other than editing the code)  is to point to a cgi script that emits
its own "Status: 404" header:
ErrorDocument 403 /cgi-bin/lie-about-the-status-code.pl

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org