ASVS 5.0 V13.4.3 is a Level 2 requirement. Your web server must not return directory listings to clients unless you explicitly intend to publish a browsable folder.
Automatic indexes turn a missing index.html into a file browser.
Why it matters
A listing shows backups, exports, old uploads and file names that hint at internal tools. Attackers use them to find db.sql.gz or config.bak without guessing. The listing is rarely the bug on its own, but it removes the guesswork from the next step.
How to implement it
nginx (off by default, make it explicit):
autoindex off;
Apache:
Options -Indexes
Node static serving:
app.use(express.static("public", { index: "index.html", redirect: false }));
// serve-index is not installed, so no listing exists
For object storage fronted by a CDN, check that public bucket listing is off even when objects are public.
If you do want a public file index, such as a download mirror, configure it for that one path and say so in a comment.
How to test it
curl -s https://example.com/static/ | grep -i "index of"
No match is the pass. Try each folder you know exists: /uploads/, /assets/, /backup/, /images/. Expect 403 or 404, not a list.
Common mistakes
- Disabling listings on the main host but not on the asset subdomain.
- Forgetting the bucket policy for the storage backend.
- Leaving a development static server in the production image.
Quick check
Does a 403 on the folder protect the files inside?
No. It only hides the list. Each file is still reachable by exact URL, so access control must be set per file.
