Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Denying via 404 instead of 403

Tags:

apache

apache2

I have the following setup for phpmyadmin:

<Directory /usr/share/phpmyadmin>
        Options FollowSymLinks
        DirectoryIndex index.php
        Order Deny,Allow
        Allow from 127.0.0.1
        Deny from all

...

</Directory>

So essentially, I only allow phpmyadmin to be accessible from localhost. If someone from the outside world attempts to go to http://mydomain/phpmyadmin they'll get a 403 (Forbidden). This might tip them off to the fact it's there, but they just can't get to it.

Question: I'd rather have Apache return a 404 in this instance. Is that possible?

like image 926
ThaDon Avatar asked Jun 25 '11 16:06

ThaDon


People also ask

Why 404 instead of 403?

You may still want to share the missing permissions or two to request access from. However, if the user shouldn't know about the resource, then neither return who to contact, the missing permissions, nor a 403 suggesting that the resource exists. In this case return the 404.

What does 403 mean?

The HTTP 403 Forbidden response status code indicates that the server understands the request but refuses to authorize it.


1 Answers

I've looked around the internet for an answer to a similar problem. While mod_rewrite is a possible solution, I find the best solution uses the "RedirectMatch" directive.

See StackOverflow: Problem redirecting 403 Forbidden to 404 Not Found

like image 141
Kevin Avatar answered Oct 07 '22 01:10

Kevin