IndexIgnore * or Options -Indexes

Question

I've always used Options -Indexes to disable directory listing through .htaccess. However, I have seen people using IndexIgnore * instead. What's the difference? Which is better than the other?

Manualmanubrium

Answer 1

The IndexIgnore directive is a pattern where files in a directory that has Indexes turned on won't show up in the auto-index if they match the pattern.

Say for example, we have a directory, foo, and inside that directory, we have an .htaccess file, and 3 files, a, b, and c.

If in the htaccess file there is Options -Indexes, then by going to http://mysite.com/foo/, I will get a 403 Forbidden response, because there is no index file (index.html, index.php, etc) and auto-index is turned off via -Indexes.

If in the htaccess file there is IndexIgnore b, then by going to http://mysite.com/foo/, I will get an auto-index response listing the files, a and c. The b file will be missing because it has been ignored. If we have IndexIgnore * in the htaccess file instead, and we go to http://mysite.com/foo/, we'll get an auto-index file that is blank, since all files have been ignored.

As for which is better, it depends on what you want. They do fundamentally two different things. Do you want auto-indexes? If not, turn it off Options -Indexes. If so, leave it on. If you don't want some things to show up in an auto-index, then use IndexIgnore.

Theodolite

So why do some people solely use IndexIgnore *? Wouldn't it be better to use Options -Indexes instead? – Manualmanubrium

Does IndexIgnore * display the index screen, but with no files then? – Manualmanubrium

@bungeshea Correct, you still see the auto-index page but with no files. – Theodolite

Thanks. Do you know if there are any performance differences? – Manualmanubrium

@bungeshea I don't have any benchmark numbers but I'm sure it is miniscule. – Theodolite

I am facing a problem where IndexIgnore * just doesn't work; Options -Indexes does. Do you know why? – Brockwell

Answer 2

There's one additional advantage of IndexIgnore * over -Indexes that's worth noting.

Sometimes it's necessary for automation to determine if a directory exists, via a GET or a HEAD request, but listing the contents of the directory would be a security issue. If you do a GET or HEAD on a directory, and have -Indexes turned on, Apache will return a 403.

However, if you put in a +Indexes, but turn on IndexIgnore *, directories that exist will return a 200 to a HEAD of GET response, but any files or directories within that directory will not be listed in a GET

Huzzah