I want to understand security implications of changing DocumentRoot in Apache to an installed website versus adding a RewriteRule.
The reason I ask this, I have a website that is installed under /var/www/html/website/. I initially changed the DocumentRoot to /var/www/html/website in the 000-default-le-ssl.conf file. This however, exposed certain elements during an NMAP scan. Specifically JS and CSS files. Examples:
https://ipaddress/nextcloud/core/js/contactsmenu.js?v=6e38f86c-7 https://IPaddress/nextcloud/core/css/guest.css?v=6e38f86c-7
and few more.
I considered this insecure behavior and hence added the following as part of the 000-default-le-ssl.conf configuration file.
I changed DocumentRoot to /var/www/html and added:
RewriteEngine on
RewriteCond %{REQUEST_URI} ^/$
RewriteRule (.*) /nextcloud/ [R=301]
Hence my question, is there any security benifit of changing DocumentRoot to default and adding a redirect or is the end result the same?
Also, I know this is product specific (nextcloud), but should such files be visible?