I'm trying to restrict per-client subdirectories of an application containing static reports using .htaccess files programatically generated with a list of users for each customer, but while I can demonstrate that the .htaccess file is being parsed (500 ISE if it contains garbage, AllowOverride is working) none of the more restrictive Require statements are overriding the Require valid-user in the higher-level Location directive.
<VirtualHost *:80> ServerName app RewriteEngine on RewriteRule ^/cgi-bin\/api\/(\w+)$ /var/www/cgi-bin/App.cgi?mode=json&request=$1 [QSA,H=cgi-script] <Directory "/var/www/cgi-bin/"> Options ExecCGI </Directory> <Directory "/var/www/cgi-bin/api/reports/"> AllowOverride FileInfo AuthConfig Options +Indexes +FollowSymLinks -ExecCGI IndexOptions +NameWidth=* SetHandler default-handler LogLevel trace8 </Directory> <Location /cgi-bin/> AuthType Basic AuthName "App Server" AuthUserFile /etc/httpd/conf.d/app.passwd require valid-user </Location> <Location /cgi-bin/api/> AuthType Basic AuthName "App API" AuthUserFile /etc/httpd/conf.d/app-api.passwd Require valid-user LogLevel trace8 </Location> </VirtualHost>
Require user CUSTOMER1
I have LogLevel trace8 on for the reports directory and I see
AH01626: authorization result of Require valid-user : denied (no authenticated user yet) AH01626: authorization result of <RequireAny>: denied (no authenticated user yet) AH01626: authorization result of Require valid-user : granted, AH01626: authorization result of <RequireAny>: granted Response sent with status 200
nothing I put in the .htaccess file seems to be referenced, wrapping Require statements in RequireAll doesn't do anything, setting Require all denied doesn't do anything, Apache is not treating the .htaccess directives as more specific than the Location directive in the config at a (higher, lefter) part of the URI.
edited: Tried adding FileInfo with no effect. Updated the example to be more complete. Settings Location /cgi-bin/api/reports/customer1 Require user CUSTOMER1 works just fine in the config, I was just trying to avoid requiring a webserver reload every time the jobs run and rebuild the .htaccess AuthZ files as some of the jobs run every minute and I didn't want to take the effort of building a more complete tool, that can reload httpd only when there are material AuthZ changes, since in theory .htaccess should be capable of making apache check for AuthZ changes on every access without privileged reloads.