2.0 Information Obtained from Server Configuration

Given a resource in the filesystem, server configuration files explain the relationship of the file to the server. First, the server configuration files indicate which files are accessible to the server and which are not, by defining the range of the filesystem accessible to the server. The configuration files also provide the filename extension to MIME type mappings needed for serving out data -- this is how a server determines the content type of a file. Special MIME types are also often used to indicate files that should be processed (or executed) by the server. In this case, this special type indicates how the file should be processed and, in some cases (notably parsed HTML documents), indicates the MIME type of the data that results from this server processing.

The configuration programs also specify any applied access controls. In this case. This is discussed in detail in section 2.3.

Finally, the server configuration files tell how to convert a directory path into a partial URL -- this is required to validate URLs within a server document collection.

2.0.1 Server as Resource Filter

Functionally, a server filters a served resource, and can see a resource in two ways: as a resource to be processed, or as data of some type to be served out with processing. In the latter case, the server determines the data type from the server's table of MIME type / filename suffices.

This is not true when the resource is a gateway program or directory. In the former case, a gateway program is executed by the server and the served data is of some unkown type -- it is up to the gateawy to return type type information to the server. If the resource is a directory, then the server can do one of three things: process the directory and generates an HTML document containing a directory listing; serves out a default document in place of the directory listing; or serve out nothing if such service is forbidden.

Thus, to understand how the server processes and serves out data, you need to know the following three things;

1. Data type of resource as seen by server -- data file, directory, executable resource (program or parsed document) or special server mapping (implying an executable resource and perhaps some served type)
2. Process Flag -- is the resource executable, and if so is the type of the returned data known for this particular executable resource.
3. Served data type --
   • Non-executable resource - type is same as that of source data
   • directory - HTML document, or nothing if forbidden by server rules
   • Executable CGI resource - type is returned by CGI program
   • Special server mapping - type is determined by mapping, if known
   • Executable parsed document - type is implied by type of source data: server-side executables of type application/x-parsed-html are served out as text/html.

2.0.2 Directory-Specific Configurations

In many cases, users can place special configuration files in directories to set directory-specific server configuration data. This can be used to customize configurational data for the current directory (and it's children) in place of the overall defaults set in the server's configuration files. The server configuration file generally lets the system manager decide which settings can and cannot be overridden by local directory configuration files, so that users cannot override global security restrictions.

---

2.1 Determining Internal and External Types

A server determines the types of a resource in three ways. Directory files are one type. A second type is any file located within the server's document directory(ies), and here the type is determined from the filename extension/MIME type and/or the status of the execute bit for a file (the extensions to MIME type database is contained within the server's configuration files). Finally, if a file is located in a special directory reserved for CGI programs, then the file is typed as an executable program regardless of the extensions.

The server configuration files provide a mapping from filename extensions to MIME-types, allowing all data files to be typed. Data type may be archived and served out in compressed form, usually indicated by appending a compression extension (.gz, .Z) to the filename. This is represented as a content-encoding MIME header sent as part of the HTTP response header returned to the client requesting the file.

With text documents, character set information may also be important, and is usually indicated as a parameter within the associated MIME Content-type header. In some cases, the same document may be offered in different language variants. For example, the Apache server would allow Spanish and French representations of the same document to be stored as the files document.es.html and document.fr.html. Thus, the MIME headers that are appropriate to any data file are:

• content-type -- e.g. text/html; charset=CHAR_SET
• content-language -- e.g. fr, en, es ... ( if text/html )
• content-encoding -- e.g. x-compress, x-gzip

This information is understood both internally and externally.

MIME-types can also indicate special mappings, such as "*.cgi" --> application/x-httpd-cgi or "*.shttp" --> application/x-parsed-html, to indicate files that should be specially processed by the server.

2.1.1 Special Types 1 -- Parsed HTML Documents

With NCSA and Apache servers, Parsed HTML documents may be indicated in two ways -- by the special extension ".shtml" (mapped onto the MIME type application/x-parsed-html) or by setting the execute bit on standard HTML documents. In these cases the server knows the served data type is text/html, and that the document must be pre-parsed by the server.

2.1.2 Special Types 2 -- Directory Reference

If the resource is a directory, how will the contents be listed when it is accessed via a server? Possibilities are:

• full listing of all contents
• restricted listing plus possible configured header and footer
• default file + name of default file

Again, the particular choice is determined by the server configuration files.

2.1.3 Special Types 3 -- Gateways Programs

Gateway programs can be indicated in two (server configurable) ways:

• placing the programs in specially server program (cgi-bin) -- directories -- the server can only run files in these directories as programs, and can never serve them out as raw files.
• special extensions for files in the document directory -- in this case, the usual extension is .cgi which maps onto the special type application/x-httpd-cgi.

In both cases the server does not know the type of data to be returned to the user-agent. In practice, the type of the returned data may be well defined, but there is no mechanism for extracting or verifying this information a priori.

2.1.4 Special Types 4 -- Server Mapped URLs

In some cases the server itself may contain compiled in modules that map certain URLs, or portions of URLs, to particular built-in processing. Examples are compiled-in imagemap programs invoked through URL root paths such as "www.xxx.org/imap/...". In both cases the type of the returned data cannot be known until the process has run. In practice, the type of the returned data may be well defined, but there is no mechanism for extracting or verifying this information a priori.

Note that, as far as I know, there is no server configuration file that explains which URL fragments are related to built-in modules. This information must therefore be extracted directly from the server source code.