unindexed

README

unindexed

A Golang HTTP FileSystem that disables directory indexing.

Motivation

By default, the http.Dir filesystem has directory indexing enabled. For example, let's say you have a .git/ folder at the root of the folder you're serving. If someone were to request your_url/.git/, the contents of the folder would be listed.

This package disables directory indexing, preventing the contents from being listed.

Installation

go get -u github.com/jordan-wright/unindexed

Usage

The easiest way to use unindexed is as a drop-in replacement for http.Dir, which is commonly used to serve static files.

Here's a simple example using the gorilla/mux router:

package main

import (
	"log"
	"net/http"

	"github.com/gorilla/mux"
	"github.com/jordan-wright/unindexed"
)

func main() {
	router := mux.NewRouter()
	router.PathPrefix("/").Handler(http.FileServer(unindexed.Dir("../static")))
	log.Fatal(http.ListenAndServe(":8080", router))
}

Other examples can be found in the examples/ directory.

Documentation

Overview

Package unindexed provides an HTTP filesystem that disables directory indexing

Motivation

By default, the "http.Dir" filesystem has directory indexing enabled, which means that if a directory is requested that doesn't include an index.html file, a list of files in the directory is returned. This could leak sensitive information and should be avoided unless needed.

Usage

The easiest way to use this package is through unindexed.Dir, which is a drop-in replacement for http.Dir. If a directory is requested that doesn't have an index.html file, this package returns a http.StatusNotFound response.

Index

• func Dir(filepath string) http.FileSystem
• type FileSystem
  • func (ufs FileSystem) Open(name string) (http.File, error)

Examples

• Dir

Functions

func Dir

func Dir(filepath string) http.FileSystem

Dir is a drop-in replacement for http.Dir, providing an unindexed filesystem for serving static files.

Example

The easiest way to use unindexed is to use the Dir function, which is a drop-in replacement to http.Dir.

package main

import (
	"net/http"

	"github.com/jordan-wright/unindexed"
)

func main() {
	http.Handle("/", http.FileServer(unindexed.Dir("./static/")))
}

Types

type FileSystem

type FileSystem struct {
	// contains filtered or unexported fields
}

FileSystem is an implementation of a standard http.FileSystem without the ability to list files in the directory. This implementation is largely inspired by https://www.alexedwards.net/blog/disable-http-fileserver-directory-listings

func (FileSystem) Open

func (ufs FileSystem) Open(name string) (http.File, error)

Open returns a file from the static directory. If the requested path ends with a slash, there is a check for an index.html file. If none exists, then an os.ErrPermission error is returned, causing a 403 Forbidden error to be returned to the client