Home / server / Questions / 706541
In Process
l0b0
Asked: 2015-07-18 05:27:42 +0800 CST

How to avoid leaking the existence of local API in Apache httpd?

  • 772

I'm building an API which will only be accessible to local services by using Require local in the <Location> directive. How can I make this return a 404 rather than 403 status code when accessed from a remote address? That way I can hide the fact that there is a service at the requested location.

I'd rather preserve the semantics of Require local than use mod_rewrite.

configuration

1 Answers

  1. Turns out this isn't too difficult:

    ErrorDocument 403 /unauthorized_remote_access
Redirect 404 /unauthorized_remote_access
    • 0