Guide to Configuring Directory Indexing and Parent Directory Access Restrictions in WAS

To build a foundation of security in the development process, this introduces methods to prevent exposure of the directory structure of WAS (Web Application Server). When directory indexing is enabled, the WAS structure, backup files, source files, and more can be exposed externally, leading to a security vulnerability.

Disabling Directory Indexing by Major WAS

Indexing should be blocked by changing settings appropriate to each server environment.

• IIS 7.0~8.0: In InetMgr.exe, change the [Directory Browsing] feature to 'Disabled'.
• Apache HTTP Server: Remove the Indexes option from Options in the configuration file (httpd.conf, etc.).
• Tomcat: Set the listings parameter value of the DefaultServlet in the web.xml file to false.
• NGINX: Change the autoindex setting in the nginx.conf file to off.

Restricting Parent Directory Access and Configuring Authentication

In special cases where directory indexing must be allowed, access to the parent directory (../) should be blocked or additional authentication should be applied.

• IIS: Set [Enable Parent Paths] to false in the ASP properties.
• Apache: Configure an authentication scheme via the AllowOverride AuthConfig setting and .htaccess file.
• Tomcat: Use an XSLT file to customize indexing so that only specific directories are indexed.
• NGINX: Control access by setting return 404 or auth_basic per location block.

Most WAS platforms block directory indexing by default, but it is essential to check whether indexing has been unnecessarily left open during initial server environment configuration.