apache2.4 (debian11): access of /.htm or /.html sites lead to 403 (and not 404)

byteunit

4/6/24, 11:13 AM

If I install apache2 on debian 11 and access one of the following urls:

http://localhost/.htm

http://localhost/.html

I don't get the expected HTTP status-code 404, I get a HTTP-status code 403 instead!

However, if I access the url http://localhost/.abc I get HTTP-status code 404.

Does anyone know, why apache returns 403 and not 404 for the not existing ./.htm and ./.html files?

I did not change any config-files, thus the config should be the default config shipped with debian 11! The virtualhost-config is the default debian virtualhost config:

<VirtualHost *:80>
    # The ServerName directive sets the request scheme, hostname and port that
    # the server uses to identify itself. This is used when creating
    # redirection URLs. In the context of virtual hosts, the ServerName
    # specifies what hostname must appear in the request's Host: header to
    # match this virtual host. For the default virtual host (this file) this
    # value is not decisive as it is used as a last resort host regardless.
    # However, you must set it for any further virtual host explicitly.
    #ServerName www.example.com

    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html

    # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
    # error, crit, alert, emerg.
    # It is also possible to configure the loglevel for particular
    # modules, e.g.
    #LogLevel info ssl:warn

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    # For most configuration files from conf-available/, which are
    # enabled or disabled at a global level, it is possible to
    # include a line for only one particular virtual host. For example the
    # following line enables the CGI configuration for this host only
    # after it has been globally disabled with "a2disconf".
    #Include conf-available/serve-cgi-bin.conf
</VirtualHost>

1 + 0

apache-2.4

apache2

Score:2

Server

vidarlo

4/6/24, 12:01 PM

This is because the Apache config contains the following snippet by default:

# The following lines prevent .htaccess and .htpasswd files from being          
# viewed by Web clients.                                                        
#                                                                               
<FilesMatch "^\.ht">
        Require all denied
</FilesMatch>

It's pretty well explained by the comment. .htaccess and .htpasswd are files that can contain security relevant configuration, and be present in the web root. Thus the default config simply blocks files starting with .ht.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: apache2.4 (debian11): access of /.htm or /.html sites lead to 403 (and not 404)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.