Default Documents and Directory Browsing

Often one will enter a URL in the browser without a specific page, e.g. http://www.billpegram.com  So when this request is sent to the server, what page, if any, will the server return? The answer to this question depends on several things:

1) Has the server been enabled to display a default document for this web site?".  Is so,

2) "What is the list of filenames including extensions that are specified as the default document?"

The list of default filenames will vary from server to server -- if you have purchased shared hosting, you will often have access to a control panel where these could be set. For example, the hosting provider www.arvixe.com uses the following list for at least some of their accounts and this list can be altered by the user. In other situations, such as the NVCC myDrive server and the NVCC faculty server, students and faculty are probably not enabled to set these.:

index.htm
default.aspx
index.php
index.html
index.pl
index.asp
index.aspx

If the server has been enabled to display a default document for this website and the URL does not include a filename, the server will return the file in the folder whose filename matches the first filename in the default document list. If the folder does not contain such a filename, it looks for the second document in the list, and so forth.  Both the filename and the extension need to match. 

The preceding paragraph thus explains the rationale for naming the home page in a website something like index.html.  If the server is configured to display a default document, the URL of the site can then be given out without specifying a filename, which makes the URL shorter.

There are two cases in which specifying merely the folder name will fail to return a document. first, the server has not been enabled to display a default document or second, there is no filename in the folder that matches one of the names in the default document list.  What happens in either case depends on the answer to a third question:

3) "Has directory browsing been enabled for this website?" 

If the answer is yes, then a list of files and folders within the folder will be displayed; if the answer is no, then a message such as "Directory listing denied" or"You are not authorized to view this page" or "404 Page Not found" will be displayed.

In most cases, webmasters will want to use default documents as home pages that then link to the other pages that the webmaster wants the user to see.  However, in some cases, directory browsing is convenient because it enables the user to see all the files in the folder on the web site on the server without the use of a FTP program.  However, in other cases, one may not want the user to see all these files, and thus one will want to include a default document in the folder and/or to not enable directory browsing. 

Although inclusion of a default document is adequate to block directory browsing in the folder in question, it does not block directory browsing in subfolders or other folders -- thus default documents must be included in each folder.  Not enabling directory browsing is simpler.

The NVCC myDrive student server enables directory browsing for each student website and the folders within.  The NVCC faculty server and www.billpegram.com do not enable directory browsing.  Where directory browsing is enabled, one sees the filename information. Where it is not enabled, one gets an error message, but the specific error message is server-dependent.

--------------------------------------------

On Windows servers running IIS, whether directory browsing is enabled and the list of filenames and extensions that qualify as a default document can be set in a config.sys file. Here is a sample config.sys file that does the following (I have bolded the applicable lines)

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<directoryBrowse enabled="false" />
<asp scriptErrorSentToBrowser="true">
<session timeout="02:50:00" />
</asp>
<defaultDocument>
<files>
<clear />
<add value="index.htm" />
<add value="default.aspx" />
<add value="index.php" />
<add value="index.html" />
<add value="index.pl" />
<add value="index.asp" />
<add value="index.aspx" />
</files>
</defaultDocument>

<httpProtocol>
<customHeaders>
<clear />
<add name="X-Powered-By" value="ASP.NET" />
</customHeaders>
</httpProtocol>
<httpErrors>
<error statusCode="500" subStatusCode="100" path="/500-100.asp" responseMode="ExecuteURL" />
</httpErrors>
</system.webServer>
<system.web>
<customErrors mode="Off" />
<compilation debug="true" />
</system.web>
</configuration>

Revised: January 28, 2020. Comments to William Pegram, wpegram@nvcc.edu