Specifications

Chapter 3 Creating and Managing Websites 57
Indexing settings also apply to subfolders placed in the user’s Sites folder. If the user
adds a content subfolder named Example to the Sites folder and an index.html le is
present inside the Example folder, or if folder indexing is enabled for that user’s site,
the folder is made available to browsers at http://example.com/~refuser/Example.
Securing Web Content on Case Insensitive File Systems
The recommended practice for serving web content whose access is controlled via
the Realm mechanism is to serve it from case-sensitive volumes, such as UFS or HFSX,
where a folder named “Protected” and another folder named “PrOtECted” are two
dierent folders.
If you use the default case-insensitive HFS le system to serve access-controlled
web content, consider using location-based realms rather than folder-based realms.
However, to use folder-based realms on a case-insensitive le system, Apple provides
a layer of protection for that scenario for Apache 2.2 using mod_hfs_apple.
The HFS Extended volume format commonly used for Mac OS X Server preserves the
case of le names but does not distinguish between a le or folder named “Example”
and one named “eXaMpLe.” Without mod_hfs_apple, this insensitivity could be an
issue when your web content resides on such a volume and you are attempting to
restrict access to all or part of your web content using security realms.
If you set up a security realm requiring browsers to use a name and a password for
Read-Only access to content in a folder named “Protected,” browsers must authenticate
to access the following URLs:
http://example.com/Protected Â
http://example.com/Protected/secret Â
http://example.com/Protected/sECreT Â
However, they could bypass it by using something like the following:
http://example.com/PrOtECted Â
http://example.com/PrOtECted/secret Â
http://example.com/PrOtECted/sECreT Â
Fortunately, mod_hfs_apple prevents those types of eorts to bypass the security
realm, and this module is enabled by default.
Note: mod_hfs_apple operates on folders; it is not intended to prevent access to
individual les. A le named “secret” can be accessed as “seCREt”. This is correct
behavior, and does not permit bypassing security realms.