CodeIgniter：从所有文件夹中删除index.html是否安全？
我是 CodeIgniter 的新手。我注意到所有 CodeIgniter 文件夹（缓存、配置、控制器、核心、错误等）都包含一个 index.html 文件，该文件基本上表示“禁止目录访问”。如果我错了，请纠正我，但我认为根据 CodeIgniter 的默认配置，不可能从网络访问这些文件夹中的任何一个。
这些index.html 文件的用途是什么？我可以直接删除它们，还是不管它们？
非常感谢。
I'm new to CodeIgniter. I notice that all CodeIgniter folders (cache, config, controllers, core, errors, etc...) contains an index.html file that basically says "Directory access is forbidden". Correct me if I'm wrong, but I don't think it is possible to get to any of these folders from the web based on CodeIgniter's default configuration.
What is the purpose of these index.html files? Can I just delete them, or do I leave them alone?
Thanks much.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
它们的目的是防止在服务器上启用目录列表时显示目录内容。 Apache 服务器默认启用目录列表。
在某些情况下，在适当的情况下您可能可以尝试直接浏览到文件夹。这些主要是由服务器配置不正确或漏洞造成的。因此，最好只保留index.html 文件（它们不会损害任何内容，并且不会占用太多空间）。
我什至建议您也将index.html 文件添加到您创建的所有文件夹中。
The purpose of them is to prevent the contents of the directory from displaying if directory listing is enabled on your server. Apache servers by default have directory listing enabled.
There are several instances where given the right circumstances you might be able to attempt to browse to a folder directly. These would mainly be caused by a server which is not configured properly, or an exploit. Therefore it is really best if you just leave the index.html files alone (they aren't hurting anything, and they don't take up that much space).
I'd even go as far as to suggest that you too add an index.html file to any and all folders which you create.
它们的存在是为了防止故障，即。如果由于某种原因目录结构可以公开浏览。
我看不出有任何理由要删除它们。
They are there for fail-safes, ie. if for some reason the directory structure would get to be publicly browsable.
I can't see any reason to remove them.
如果您的 codeigniter 安装（系统和应用程序文件夹）位于公共服务器目录之外，那么它们不会提供任何帮助，因为它们永远无法提供服务。在这种情况下，它们是否存在并不重要，因为无论如何您都无法访问它们的目录。
If your codeigniter installation (system and app folders) is outside of your public server directory, then they're not going to help with anything since they could never be served. In that case, it doesn't matter whether they exist or not, since you could never get to their directories anyway.
我说删除它们有两个原因：
1）如果 Apache 配置为允许目录浏览，那么你的 index.html 内容并不重要。因此，声称“如果禁止则访问目录”，而实际上并非如此，相当于通过模糊来实现安全，这是一种不受欢迎的安全策略。
2）我不同意“如果它不伤害任何东西，就不要管它”的想法。我花了很多个小时试图弄清楚一段特定代码的用途，后来才发现它根本没有做任何事情。删除未使用的代码。你的项目的继承者会少诅咒你。
I say remove them for two reasons:
1) If Apache is configured to allow directory browsing, then it doesn't matter what your index.html says. So claiming that "Directory access if forbidden" when it's really not, amounts to security through obscurity, which is an undesirable security strategy.
2) I disagree with the idea that "if it's not hurting anything, just leave it alone". I've spent many an hour trying to figure out the purpose of a particular piece of code, only later to find out that it wasn't doing anything at all. Remove unused code. The inheritors of your projects will curse you less.
它们是为了您的安全，如果有人尝试通过您的域 URL 访问服务器上的文件夹（如果您的服务器配置错误），它将通过触发该操作来阻止您加载这些文件HTML 文件
保留该文件对您来说确实是安全的。
They are for your security, if someone tries to access your folder on the server by your domain URL (if your server is configured in a wrong way), it will prevent you from loading those files by triggering that HTML file
It would be safe for you to keep the file indeed.