Take the 2-minute tour ×

We have a rails application in subversion that we deploy with Capistrano but have noticed that we can access the files in '/.svn', which presents a security concern.

I wanted to know what the best way to do this. A few ideas:

  • Global Apache configuration to deny access
  • Adding .htaccess files in the public folder and all subfolders
  • Cap task that changes the permissions

I don't really like the idea of deleting the folders or using svn export, since I would like to keep the 'svn info' around.

share|improve this question
By the way, you don't need to put .htaccess files in subfolders, the rules automatically apply to all subdirectories. –  Vinko Vrsalovic Dec 29 '08 at 16:46
add comment

10 Answers

up vote 47 down vote accepted

The best option is to use Apache configuration.

Using htaccess or global configuration depends mainly on if you control your server.

If you do, you can use something like

<DirectoryMatch .*\.svn/.*>
    Deny From All

If you don't, you can do something similar in .htaccess files with FilesMatch

share|improve this answer
I could not get this to work with .htaccess and FilesMatch. I could get it to block a request to site.com/.svn, but I could still access files if I directly requested them. For now I am using the RedirectMatch as suggested below. The other option is a RewriteRule. –  Tao Zhyn Feb 12 '09 at 23:09
I used this approach combined with Riccardo Galli's list of multiple cvs systems to great effect: <DirectoryMatch .*\.(svn|git|hg|bzr|cvs)/.*> Deny From All </DirectoryMatch> This matches all subdirectories / files also. It reveals only if the top level directory exists (otherwise it would return a 404) but .svn/doesnotexist returns a 403. –  chmac Jul 31 '12 at 13:17
add comment

One other way to protect the .svn files would be to use a redirect in the Apache config:

RedirectMatch 404 /\\.svn(/|$)

So instead of getting a 403 forbidden (and providing clues to would be attackers) you get a 404, which is what we would expect when randomly typing in paths.

share|improve this answer
Yes, this is non HTTP-compliant though :) –  Vinko Vrsalovic Dec 29 '08 at 18:17
Why is this not HTTP-compliant? By the way, it worked great for me, thanks! –  mmmshuddup Apr 2 '12 at 3:36
add comment

I do not like the idea of 404ing each file startig wit a dot. I'd use a more selective approach, either with the cvs I'm using in the project (svn in the example)

RedirectMatch 404 /\\.svn(/|$)

or a catch all cvs systems

RedirectMatch 404 /\\.(svn|git|hg|bzr|cvs)(/|$)

-- outdated answer follows (see comments) --

I cant write comments yet so... The answer of csexton is incorrect, because an user cannot access the .svn folder, but can access any files inside it ! e.g. you can access http://myserver.com/.svn/entries

The correct rule is

RedirectMatch 404 /\\.svn(/.*|$)
share|improve this answer
The .* is not necessary, the answer of csexton is sufficient. csexton's regex matches "/.svn" at the end of the requested path or "/.svn/" anywhere in the requested path. So it will also work for requests to /path/to/.svn/entries. –  Stefan Sep 29 '11 at 9:27
Did you try? I did and I had access to .svn/entries with csexton rule –  Riccardo Galli Sep 29 '11 at 11:42
I'm using the rule RedirectMatch 404 /\.svn(/|$) on Apache 2.2 and get a 404 with /.svn/entries –  Stefan Sep 29 '11 at 15:08
You're right. I wrote this answer because the behaviour was different at that time. It seems like today Apache use the regexp as partial if $ is missing (which makes sense). I'll update my answer. Thank you –  Riccardo Galli Sep 29 '11 at 19:26
I suspected something like that, that's why I mentioned my Apache version number. The current behaviour makes more sense, that's right. –  Stefan Sep 29 '11 at 19:39
add comment

I think Riccardo Galli got it right. Even apache already had .svn setup as forbidden for me, but .svn/entries was certainly available...exposing my svn server, port number, usernames, etc.

I actually figure, why not restrict .git as a preventative measure (say you don't use git yet but may someday at which time you will not be thinking about directory restrictions).

And then I thought, why not restrict everything that should be hidden anyway? Can anyone conceive of a problem with this?

RedirectMatch 404 /\\..*(/.*|$)

I added the '.*' after the initial period - only difference from Riccardo. Seems to 404 .svn, .git, .blah, etc.

share|improve this answer
This seems to work well. –  Adrian Schmidt Mar 16 '11 at 11:10
This works well with .hg (Mercurial). It protects also the nested folders and files. –  MZAweb May 11 '11 at 19:59
Because you only have to check if a URL path contains a forward-slash followed by a dot, this should also work: RedirectMatch 404 /\. –  Robert Ros Aug 17 '11 at 10:09
The cleanest formally-correct regex would be: RedirectMatch 404 /\..*$ –  lucaferrario Aug 16 '13 at 9:09
add comment

I would rather deny access to all dot-files (eg: .htaccess, .svn, .xxx, etc.), as they normally don't need to be web-accessible.

Here's the rule to achieve this:

<LocationMatch "\/\..*">
    Order allow,deny
    Deny from all
share|improve this answer
add comment

A RedirectMatch will respond with a 404, which is great.

However, if "Options +Indexes" is enabled, then users will still be able to see the '.svn' directory from the Parent directory.

Users won't be able to enter the directory-- this is where the '404 Not Found' comes in. However, they will be able to see the directory and provide clues to would be attackers.

share|improve this answer
add comment

I seems to me, Apache conf should be :

<Directory ~ "\.svn">
    Order allow,deny
    Deny from all
share|improve this answer
add comment


RedirectMatch permanent .*\.(svn|git|hg|bzr|cvs)/.* /

can also be used if you don't want to send an error back to the user.

It's only redirecting back to the site rootpage. Also, this is a permanent redirect, so the robots won't try to reindex this URL.

share|improve this answer
add comment

I'm not all that fond of RewriteMatch, so I used a RewriteRule instead:

RewriteRule /\..*(/.*|$) - [R=404,L]

The hyphen means "don't do any substitution". I also could not figure out why, in the examples above, the regex had two backslashes:


So I took one out and it works fine. I can't figure out why you would use two there. Someone care to enlighten me?

share|improve this answer
add comment

Create a access rights file in your subversion server installation.

e.g if you folder structure is



create a configuration file and enter the path of that file in your apache subversion configuration file which you would normally find at /etc/httpd/conf.d/subversion.conf

In your svnauth.conf file define the rights as :

access rights for Foo.com



dev2=rw .....

This way you can control the access rights from one single file and at much granular level.

For more information peruse through the svn red book.

share|improve this answer
You have misunderstood the question. He is talking about the .svn directory that gets created on checkout, not about developers permissions on the repository –  Vinko Vrsalovic Dec 29 '08 at 18:00
add comment

Your Answer


