Apache HTTP Server Version 2.4

Apache > HTTP Server > Documentation > Version 2.4 > Modules

# Apache Module mod_userdir

Description: | User-specific directories
Status: | Base
Module Identifier: | userdir_module
Source File: | mod_userdir.c

### Summary

By using this module you are allowing multiple users to host content within the same origin. The same origin policy is a key principle of Javascript and web security. By hosting web pages in the same origin these pages can read and control each other and security issues in one page may affect another. This is particularly dangerous in combination with web pages involving dynamic content and authentication and when your users don't necessarily trust each other.

This module allows user-specific directories to be accessed using the `http://example.com/~user/` syntax.

### Directives

### Bugfix checklist

- httpd changelog
- Known issues
- Report a bug

### See also

- Mapping URLs to the Filesystem
- public_html tutorial

## UserDir Directive

Description: | Location of the user-specific directories
Syntax: | `UserDir directory-filename [directory-filename] ...`
Context: | server config, virtual host
Status: | Base
Module: | mod_userdir

The `UserDir` directive sets the real directory in a user's home directory to use when a request for a document for a user is received. Directory-filename is one of the following:

- The name of a directory or a pattern such as those shown below.
- The keyword `disabled`. This turns off all username-to-directory translations except those explicitly named with the `enabled` keyword (see below).
- The keyword `disabled` followed by a space-delimited list of usernames. Usernames that appear in such a list will never have directory translation performed, even if they appear in an `enabled` clause.
- The keyword `enabled` followed by a space-delimited list of usernames. These usernames will have directory translation performed even if a global disable is in effect, but not if they also appear in a `disabled` clause.

If neither the `enabled` nor the `disabled` keywords appear in the `Userdir` directive, the argument is treated as a filename pattern, and is used to turn the name into a directory specification. A request for `http://www.example.com/~bob/one/two.html` will be translated to:

UserDir directive used | Translated path
--- | ---
UserDir public_html | ~bob/public_html/one/two.html
UserDir /usr/web | /usr/web/bob/one/two.html
UserDir /home/*/www | /home/bob/www/one/two.html

The following directives will send redirects to the client:

UserDir directive used | Translated path
--- | ---
UserDir http://www.example.com/users | http://www.example.com/users/bob/one/two.html
UserDir http://www.example.com/*/usr | http://www.example.com/bob/usr/one/two.html
UserDir http://www.example.com/~*/ | http://www.example.com/~bob/one/two.html

Be careful when using this directive; for instance, `"UserDir ./"` would map `"/~root"` to `"/"` - which is probably undesirable. It is strongly recommended that your configuration include a "`UserDir disabled root`" declaration. See also the `Directory` directive and the Security Tips page for more information.

Additional examples:

To allow a few users to have `UserDir` directories, but not anyone else, use the following:

    UserDir disabled
    UserDir enabled user1 user2 user3

To allow most users to have `UserDir` directories, but deny this to a few, use the following:

    UserDir disabled user4 user5 user6

It is also possible to specify alternative user directories. If you use a command like:

    UserDir "public_html" "/usr/web" "http://www.example.com/"

With a request for `http://www.example.com/~bob/one/two.html`, will try to find the page at `~bob/public_html/one/two.html` first, then `/usr/web/bob/one/two.html`, and finally it will send a redirect to `http://www.example.com/bob/one/two.html`.

If you add a redirect, it must be the last alternative in the list. Apache httpd cannot determine if the redirect succeeded or not, so if you have the redirect earlier in the list, that will always be the alternative that is used.

User directory substitution is not active by default in versions 2.1.4 and later. In earlier versions, `UserDir public_html` was assumed if no `UserDir` directive was present.

### Merging details

Lists of specific enabled and disabled users are replaced, not merged, from global to virtual host scope

### See also

- Per-user web directories tutorial