Apache HTTPD / Representation, proxying, and capacity / Lesson 7

Content types, directory indexes, and handlers

Separate resource selection, response metadata, execution, and automatic listings.

About 4 min readContent reviewed 2026-10-28

On this page

Lesson goals

Explain MIME type versus handler behavior.
Review DirectoryIndex and listing as different request outcomes.

Metadata and execution are different decisions

A selected resource can have a content type, character encoding, content encoding, handler, and filters. mod_mime associates extensions with supported metadata and behavior according to configuration, while other modules can select handlers. Parcel’s status.json should be described accurately as JSON, but a Content-Type alone does not prove valid bytes or execute a program. Do not treat a filename extension as a security boundary. A missing dynamic handler can expose source or change behavior, so review executable content placement and required modules deliberately.

A directory request can select an index or listing

mod_dir handles directory slash behavior and configured index resources, while mod_autoindex can generate a listing when applicable. These are different mechanisms. A request for /docs without a trailing slash can need a redirect so relative links resolve correctly. DirectoryIndex can select index.html through the request-processing contract rather than returning a listing. Disabling Indexes does not remove a valid configured index file or deny every known path. Diagnose the selected outcome before changing authorization or adding unrelated files.

Declare one static-content contract

The fragment below selects a synthetic index filename, disables listing, and associates .json with application/json. It assumes appropriate core, directory, MIME, and authorization support and is never loaded. No file is created or parsed by Apache. It is not a universal static-site configuration: inherited handlers, negotiation, language and charset settings, and other matching sections still matter. The intended directory contains only reviewed public static content, not secrets or application source that relies on execution to remain confidential.

apache An illustrative static representation scope

<Directory "/lab/parcel/public">
    DirectoryIndex index.html
    Options -Indexes
    AddType application/json .json
    Require all granted
</Directory>

The path and content are assumptions. No index lookup, MIME resolution, listing, file permission, or request is tested. Dynamic handler configuration is intentionally outside this fragment.

Validate one payload independently of its label

The complete local program below parses declared JSON text and separately looks up a declared extension label. Both checks succeed, but they establish different facts. This is not MIME sniffing, Apache content negotiation, or response-header validation. A real review needs actual selected bytes and metadata for the intended route, plus safe handling of untrusted uploads. Giving an arbitrary payload a .json extension does not make it valid JSON, and declaring a media type does not authorize its distribution.

python A synthetic payload-and-label check

import json
payload = '{"service":"parcel-lab","ok":true}'
types = {".json": "application/json"}
value = json.loads(payload)
print(types[".json"])
print(value["ok"] is True)

Expected output

application/json
True

Only an embedded string and dictionary are used. No file, handler, HTTP header, browser, or server is inspected.

Trace unexpected downloads or source display

If a browser downloads a response, renders the wrong encoding, or displays application source, preserve the selected site, handler, headers, and bounded content evidence without publishing secrets. Check effective module support and overrides rather than guessing from the filename. A temporary content-type change can hide a handler problem while leaving source exposed. ErrorDocument and internal redirects can also change which content is ultimately returned. Keep status, representation, handler, and authorization outcomes explicit and verify the intended user behavior in a separately authorized process.

Common errors and fixes

A media type is expected to execute a dynamic application.

Why it happens: Representation metadata was confused with a configured content handler.
How to fix it: Review the actual handler and required integration separately.
Prevent it next time: Keep executable source outside assumptions of static public content.

Disabling Indexes is assumed to remove DirectoryIndex behavior.

Why it happens: Automatic listing and configured index selection were conflated.
How to fix it: Inspect the intended directory request and supported module behavior.
Prevent it next time: Test slash, index, listing, and direct-file cases separately.

A .json suffix is treated as proof of valid safe JSON.

Why it happens: Filename metadata replaced content and authorization checks.
How to fix it: Validate actual bytes and intended distribution independently.
Prevent it next time: Review uploads, type labels, and serving policy as separate contracts.

Check your understanding

1. The model labels .json correctly. Does that prove an arbitrary status.json file is valid JSON?

Show worked solution

No. The label dictionary and content parser are independent. The program validates only its embedded payload. Actual selected bytes, encoding, and distribution policy need appropriate evidence; a filename does not prove those properties.

2. A directory request returns index.html despite Options -Indexes. Is that necessarily a configuration failure?