internal: disable directory listing on static files

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>

internal/web/web_static.go

@@ -11,21 +11,32 @@ import (
 
 func (ws *WebServer) configureStatic() {
 	statRouter := ws.lh.NewRoute().Subrouter()
+	statRouter.Use(disableIndex)
 	// Media files, always local
 	fs := http.FileServer(http.Dir(config.G.Paths.Media))
+	var distHandler http.Handler
+	var authentikHandler http.Handler
+	var helpHandler http.Handler
 	if config.G.Debug || config.G.Web.LoadLocalFiles {
 		ws.log.Debug("Using local static files")
-		statRouter.PathPrefix("/static/dist").Handler(http.StripPrefix("/static/dist", http.FileServer(http.Dir("./web/dist"))))
+		distHandler = http.StripPrefix("/static/dist/", http.FileServer(http.Dir("./web/dist")))
-		statRouter.PathPrefix("/static/authentik").Handler(http.StripPrefix("/static/authentik", http.FileServer(http.Dir("./web/authentik"))))
+		authentikHandler = http.StripPrefix("/static/authentik/", http.FileServer(http.Dir("./web/authentik")))
-		statRouter.PathPrefix("/help").Handler(http.StripPrefix("/help", http.FileServer(http.Dir("./website/help"))))
+		helpHandler = http.StripPrefix("/help/", http.FileServer(http.Dir("./website/help")))
 	} else {
 		statRouter.Use(ws.staticHeaderMiddleware)
 		ws.log.Debug("Using packaged static files with aggressive caching")
-		statRouter.PathPrefix("/static/dist").Handler(http.StripPrefix("/static", http.FileServer(http.FS(staticWeb.StaticDist))))
+		distHandler = http.StripPrefix("/static", http.FileServer(http.FS(staticWeb.StaticDist)))
-		statRouter.PathPrefix("/static/authentik").Handler(http.StripPrefix("/static", http.FileServer(http.FS(staticWeb.StaticAuthentik))))
+		authentikHandler = http.StripPrefix("/static", http.FileServer(http.FS(staticWeb.StaticAuthentik)))
-		statRouter.PathPrefix("/help").Handler(http.FileServer(http.FS(staticDocs.Help)))
+		helpHandler = http.FileServer(http.FS(staticDocs.Help))
 	}
-	statRouter.PathPrefix("/media").Handler(http.StripPrefix("/media", fs))
+	statRouter.PathPrefix("/static/dist/").Handler(distHandler)
+	statRouter.PathPrefix("/static/authentik/").Handler(authentikHandler)
+
+	statRouter.PathPrefix("/media/").Handler(http.StripPrefix("/media", fs))
+
+	statRouter.PathPrefix("/if/help/").Handler(helpHandler)
+	statRouter.PathPrefix("/help").Handler(http.RedirectHandler("/if/help/", http.StatusMovedPermanently))
+
 	ws.lh.Path("/robots.txt").HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 		rw.Header()["Content-Type"] = []string{"text/plain"}
 		rw.WriteHeader(200)

internal/web/web_static_utils.go

@@ -0,0 +1,17 @@
+package web
+
+import (
+	"net/http"
+	"strings"
+)
+
+func disableIndex(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/") {
+			http.NotFound(w, r)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}