By default, Apache server allows directory browsing. If a URL which maps to a directory is requested, and there is no DirectoryIndex (index.html for example) in the directory, then the server returns a formatted listing of the directory.
If you want to prevent people from browsing your directory, you can add this code to your .htaccess file :
Option -Indexes
The Options directive controls which server features are available in a particular directory. Using -Indexes disables listing of the directory.
