How to make Apache ErrorDocuments unreachable by normal http requests?

Question

The Apache documentation explains, how can we set up custom error pages for different HTTP errors, identified by their status code (401, 403, 404, 500, 503 and so on).

However, what this document says, is essentially this: in the case of an error, Apache generates an internal sub-request for a document.

For example, an

ErrorDocument 404 /errors/dunno.html
ErrorDocument 500 /errors/sux.html

lines will result that the documents /errors/dunno.html and /errors/sux.html will be served in the case of a 404 (file not found) or 500 (internal server) error.

However, it also means that a http request for https://my.server/errors/sux.html will serve that sux.html, as an ordinary file.

This is not what I want.

I want the error pages should live out of the DocumentRoot, and they should be totally unreachable with ordinary http queries. The only case, when they should be served, if Apache serves a (non-200) http answer which is affected by an ErrorDocument directive in its configuration.

Can I somehow do this?

Answer 1

Have you actually tested the ErrorDocument ? Two things that I noticed when I did it...

I tried setting up a fake URL based API where the 404 errordoc was my master API PHP script, which would then return the content after parsing the requested URL. Worked as normal in a browser and the URL displayed was the one requested, NOT the ErrorDocument.

However, AngularJS was complaining about the 404 status code even though the content of the message was the json that was requested.

So...

Apache and ErrorDocuments can/will display the requested URL, not the URL of the ErrorDocument. So unless they can guess your naming scheme, no direct access is possible.

The client is still sent a 404 or other appropriate HTTP status code, not a 200/OK.

Apache logs the request as a 404, showing the requested URL if configured to log that way.

Just tested on default install of apache2.4.x on both Debian and Ubuntu systems using default config other than adding an ErrorDocument 404 /test.html directive.