How to disallow directory browsing on web server

[Mike London]

How do you keep someone from typing the URL to a directory in a browser and then having full access to all the files in it?
Often when I do this by accident, I get the message: "Access denied, you do not have permissions to view this folder" (or words to that effect).
How do I set this up?
Is this is a web server permissions issue or does it have to be handled some other way?
Thanks in advance.
-- Mike

[Mark Bensing]

How you disable directory browsing depends on the server that you are using. I can tell you that for Tomcat 4.1 you want to go to the web.xml file in $CATALINA_HOME/conf. In there you will an entry for the default servlet:

  <!-- The default servlet for all web applications, that serves static     -->
  <!-- resources.  It processes all requests that are not mapped to other   -->
  <!-- servlets with servlet mappings (defined either here or in your own   -->
  <!-- web.xml file.  This servlet supports the following initialization    -->
  <!-- parameters (default values are in square brackets):                  -->
  <!--                                                                      -->
  <!--   debug               Debugging detail level for messages logged     -->
  <!--                       by this servlet.  [0]                          -->
  <!--                                                                      -->
  <!--   input               Input buffer size (in bytes) when reading      -->
  <!--                       resources to be served.  [2048]                -->
  <!--                                                                      -->
  <!--   listings            Should directory listings be produced if there -->
  <!--                       is no welcome file in this directory?  [true]  -->
  <!--                                                                      -->
  <!--   output              Output buffer size (in bytes) when writing     -->
  <!--                       resources to be served.  [2048]                -->
  <!--                                                                      -->
  <!--   readonly            Is this context "read only", so HTTP           -->
  <!--                       commands like PUT and DELETE are               -->
  <!--                       rejected?  [true]                              -->
    <servlet>
        <servlet-name>default</servlet-name>
        <servlet-class>
          org.apache.catalina.servlets.DefaultServlet
        </servlet-class>
        <init-param>
            <param-name>debug</param-name>
            <param-value>0</param-value>
        </init-param>
        <init-param>
            <param-name>listings</param-name>
            <param-value>true</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

Just change the value of the listings init-param to false.
I hope this helps,
Mark

[Mike London]

With my web hosting company I can only have one "web app".
Is there a solution for all the other apps I have hosted as well?
Thanks in advance for your reply.
-- Mike