sections.html.en revision fac8c35bfb158112226ab43ddf84d59daca5dc30
842ae4bd224140319ae7feec1872b93dfd491143fielding<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
842ae4bd224140319ae7feec1872b93dfd491143fielding<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
842ae4bd224140319ae7feec1872b93dfd491143fielding XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
842ae4bd224140319ae7feec1872b93dfd491143fielding This file is generated from xml source: DO NOT EDIT
842ae4bd224140319ae7feec1872b93dfd491143fielding XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<title>Configuration Sections - Apache HTTP Server</title>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<link href="/style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<link href="/style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<link href="/style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<link href="/images/favicon.ico" rel="shortcut icon" /></head>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="/faq/">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p class="apache">Apache HTTP Server Version 2.3</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<div class="up"><a href="./"><img title="<-" alt="<-" src="/images/left.gif" /></a></div>
e8f95a682820a599fe41b22977010636be5c2717jim<a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="./">Version 2.3</a></div><div id="page-content"><div id="preamble"><h1>Configuration Sections</h1>
e8f95a682820a599fe41b22977010636be5c2717jim<p><span>Available Languages: </span><a href="/en/sections.html" title="English"> en </a> |
1747d30b98aa1bdbc43994c02cd46ab4cb9319e4fielding<a href="/ja/sections.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> |
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<a href="/ko/sections.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> |
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<a href="/tr/sections.html" hreflang="tr" rel="alternate" title="T�rk�e"> tr </a></p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes <p>Directives in the <a href="configuring.html">configuration files</a> may apply to the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesentire server, or they may be restricted to apply only to particular
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdirectories, files, hosts, or URLs. This document describes how to
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesuse configuration section containers or <code>.htaccess</code> files
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesto change the scope of other configuration directives.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<div id="quickview"><ul id="toc"><li><img alt="" src="/images/down.gif" /> <a href="#types">Types of Configuration Section Containers</a></li>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<li><img alt="" src="/images/down.gif" /> <a href="#file-and-web">Filesystem and Webspace</a></li>
5c0419d51818eb02045cf923a9fe456127a44c60wrowe<li><img alt="" src="/images/down.gif" /> <a href="#virtualhost">Virtual Hosts</a></li>
5c0419d51818eb02045cf923a9fe456127a44c60wrowe<li><img alt="" src="/images/down.gif" /> <a href="#proxy">Proxy</a></li>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<li><img alt="" src="/images/down.gif" /> <a href="#whatwhere">What Directives are Allowed?</a></li>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<li><img alt="" src="/images/down.gif" /> <a href="#mergin">How the sections are merged</a></li>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<h2><a name="types" id="types">Types of Configuration Section Containers</a></h2>
d266c3777146d36a4c23c17aad6f153aebea1bf4jorton<table class="related"><tr><th>Related Modules</th><th>Related Directives</th></tr><tr><td><ul><li><code class="module"><a href="/mod/core.html">core</a></code></li><li><code class="module"><a href="/mod/mod_version.html">mod_version</a></code></li><li><code class="module"><a href="/mod/mod_proxy.html">mod_proxy</a></code></li></ul></td><td><ul><li><code class="directive"><a href="/mod/core.html#directory"><Directory></a></code></li><li><code class="directive"><a href="/mod/core.html#directorymatch"><DirectoryMatch></a></code></li><li><code class="directive"><a href="/mod/core.html#files"><Files></a></code></li><li><code class="directive"><a href="/mod/core.html#filesmatch"><FilesMatch></a></code></li><li><code class="directive"><a href="/mod/core.html#ifdefine"><IfDefine></a></code></li><li><code class="directive"><a href="/mod/core.html#ifmodule"><IfModule></a></code></li><li><code class="directive"><a href="/mod/mod_version.html#ifversion"><IfVersion></a></code></li><li><code class="directive"><a href="/mod/core.html#location"><Location></a></code></li><li><code class="directive"><a href="/mod/core.html#locationmatch"><LocationMatch></a></code></li><li><code class="directive"><a href="/mod/mod_proxy.html#proxy"><Proxy></a></code></li><li><code class="directive"><a href="/mod/mod_proxy.html#proxymatch"><ProxyMatch></a></code></li><li><code class="directive"><a href="/mod/core.html#virtualhost"><VirtualHost></a></code></li></ul></td></tr></table>
d266c3777146d36a4c23c17aad6f153aebea1bf4jorton<p>There are two basic types of containers. Most containers are
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesevaluated for each request. The enclosed directives are applied only
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesfor those requests that match the containers. The <code class="directive"><a href="/mod/core.html#ifdefine"><IfDefine></a></code>, <code class="directive"><a href="/mod/core.html#ifmodule"><IfModule></a></code>, and
22f8da8087791fcb95b836c8a81937c5a9bba202bnicholes<code class="directive"><a href="/mod/mod_version.html#ifversion"><IfVersion></a></code>
22f8da8087791fcb95b836c8a81937c5a9bba202bnicholescontainers, on the other hand, are evaluated only at server startup
22f8da8087791fcb95b836c8a81937c5a9bba202bnicholesand restart. If their conditions are true at startup, then the
22f8da8087791fcb95b836c8a81937c5a9bba202bnicholesenclosed directives will apply to all requests. If the conditions are
22f8da8087791fcb95b836c8a81937c5a9bba202bnicholesnot true, the enclosed directives will be ignored.</p>
22f8da8087791fcb95b836c8a81937c5a9bba202bnicholes<p>The <code class="directive"><a href="/mod/core.html#ifdefine"><IfDefine></a></code> directive
cd3bbd6d2df78d6c75e5d159a81ef8bdd5f70df9trawickencloses directives that will only be applied if an appropriate
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesparameter is defined on the <code class="program"><a href="/programs/httpd.html">httpd</a></code> command line. For example,
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholeswith the following configuration, all requests will be redirected
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesto another site only if the server is started using
0568280364eb026393be492ebc732795c4934643jorton<IfDefine ClosedForNow><br />
0568280364eb026393be492ebc732795c4934643jorton</IfDefine>
0568280364eb026393be492ebc732795c4934643jorton<p>The <code class="directive"><a href="/mod/core.html#ifmodule"><IfModule></a></code>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdirective is very similar, except it encloses directives that will
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcoveneronly be applied if a particular module is available in the server.
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerThe module must either be statically compiled in the server, or it
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesmust be dynamically compiled and its <code class="directive"><a href="/mod/mod_so.html#loadmodule">LoadModule</a></code> line must be earlier in the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesconfiguration file. This directive should only be used if you need
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesyour configuration file to work whether or not certain modules are
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesinstalled. It should not be used to enclose directives that you want
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesto work all the time, because it can suppress useful error messages
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesabout missing modules.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>In the following example, the <code class="directive"><a href="/mod/mod_mime_magic.html#mimemagicfiles">MimeMagicFiles</a></code> directive will be
796e4a7141265d8ed7036e4628161c6eafb2a789jortonapplied only if <code class="module"><a href="/mod/mod_mime_magic.html">mod_mime_magic</a></code> is available.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</IfModule>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>The <code class="directive"><a href="/mod/mod_version.html#ifversion"><IfVersion></a></code>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdirective is very similar to <code class="directive"><a href="/mod/core.html#ifdefine"><IfDefine></a></code> and <code class="directive"><a href="/mod/core.html#ifmodule"><IfModule></a></code>, except it encloses directives that will
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesonly be applied if a particular version of the server is executing. This
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesmodule is designed for the use in test suites and large networks which have to
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdeal with different httpd versions and different configurations.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes <IfVersion >= 2.1><br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes # this happens only in versions greater or<br />
482f676c6c19b1c5bb5cca04dad11509c1da3a4cwrowe # equal 2.1.0.<br />
482f676c6c19b1c5bb5cca04dad11509c1da3a4cwrowe </IfVersion>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p><code class="directive"><a href="/mod/core.html#ifdefine"><IfDefine></a></code>,
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<code class="directive"><a href="/mod/core.html#ifmodule"><IfModule></a></code>, and the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<code class="directive"><a href="/mod/mod_version.html#ifversion"><IfVersion></a></code>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholescan apply negative conditions by preceding their test with "!".
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesAlso, these sections can be nested to achieve more complex
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesrestrictions.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</div><div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
713a2b68bac4aeb1e9c48785006c0732451039depquerna<h2><a name="file-and-web" id="file-and-web">Filesystem and Webspace</a></h2>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>The most commonly used configuration section containers are the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesones that change the configuration of particular places in the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesfilesystem or webspace. First, it is important to understand the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdifference between the two. The filesystem is the view of your disks
482f676c6c19b1c5bb5cca04dad11509c1da3a4cwroweas seen by your operating system. For example, in a default install,
482f676c6c19b1c5bb5cca04dad11509c1da3a4cwroweApache resides at <code>/usr/local/apache2</code> in the Unix
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesfilesystem or <code>"c:/Program Files/Apache Group/Apache2"</code> in
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesthe Windows filesystem. (Note that forward slashes should always be
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesused as the path separator in Apache, even for Windows.) In contrast,
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesthe webspace is the view of your site as delivered by the web server
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesand seen by the client. So the path <code>/dir/</code> in the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholeswebspace corresponds to the path
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<code>/usr/local/apache2/htdocs/dir/</code> in the filesystem of a
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdefault Apache install on Unix. The webspace need not map directly to
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerthe filesystem, since webpages may be generated dynamically
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesfrom databases or other locations.</p>
f43b67c5a9d29b572eac916f8335cedc80c908bebnicholes<h3><a name="filesystem" id="filesystem">Filesystem Containers</a></h3>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>The <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code>
8113dac419143273351446c3ad653f3fe5ba5cfdwroweand <code class="directive"><a href="/mod/core.html#files"><Files></a></code>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdirectives, along with their <a class="glossarylink" href="/glossary.html#regex" title="see glossary">regex</a>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholescounterparts, apply directives to
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesparts of the filesystem. Directives enclosed in a <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> section apply to
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesthe named filesystem directory and all subdirectories of that
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdirectory. The same effect can be obtained using <a href="howto/htaccess.html">.htaccess files</a>. For example, in the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesfollowing configuration, directory indexes will be enabled for the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<code>/var/web/dir1</code> directory and all subdirectories.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesOptions +Indexes<br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</Directory>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<p>Directives enclosed in a <code class="directive"><a href="/mod/core.html#files"><Files></a></code> section apply to any file with
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerthe specified name, regardless of what directory it lies in.
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerSo for example, the following configuration directives will,
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerwhen placed in the main section of the configuration file,
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdeny access to any file named <code>private.html</code> regardless
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerof where it is found.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesOrder allow,deny<br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesDeny from all<br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</Files>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<p>To address files found in a particular part of the filesystem, the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<code class="directive"><a href="/mod/core.html#files"><Files></a></code> and
8113dac419143273351446c3ad653f3fe5ba5cfdwrowe<code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> sections
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholescan be combined. For example, the following configuration will deny
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<code>/var/web/dir1/subdir3/private.html</code>, and any other instance
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesof <code>private.html</code> found under the <code>/var/web/dir1/</code>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdirectory.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesOrder allow,deny<br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesDeny from all<br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</Files><br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</Directory>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<h3><a name="webspace" id="webspace">Webspace Containers</a></h3>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<p>The <code class="directive"><a href="/mod/core.html#location"><Location></a></code>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdirective and its <a class="glossarylink" href="/glossary.html#regex" title="see glossary">regex</a> counterpart, on
8113dac419143273351446c3ad653f3fe5ba5cfdwrowethe other hand, change the
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesconfiguration for content in the webspace. For example, the following
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesconfiguration prevents access to any URL-path that begins in /private.
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesIn particular, it will apply to requests for
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<code>http://yoursite.example.com/private123</code>, and
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<code>http://yoursite.example.com/private/dir/file.html</code> as well
f43b67c5a9d29b572eac916f8335cedc80c908bebnicholesas any other requests starting with the <code>/private</code> string.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<Location /private><br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesOrder Allow,Deny<br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesDeny from all<br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</Location>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>The <code class="directive"><a href="/mod/core.html#location"><Location></a></code>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesdirective need not have anything to do with the filesystem.
f43b67c5a9d29b572eac916f8335cedc80c908bebnicholesFor example, the following example shows how to map a particular
e8f95a682820a599fe41b22977010636be5c2717jimURL to an internal Apache handler provided by <code class="module"><a href="/mod/mod_status.html">mod_status</a></code>.
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerNo file called <code>server-status</code> needs to exist in the
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerfilesystem.</p>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<Location /server-status><br />
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerSetHandler server-status<br />
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener</Location>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<h3><a name="wildcards" id="wildcards">Wildcards and Regular Expressions</a></h3>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<p>The <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code>,
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<code class="directive"><a href="/mod/core.html#files"><Files></a></code>, and
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<code class="directive"><a href="/mod/core.html#location"><Location></a></code>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerdirectives can each use shell-style wildcard characters as in
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<code>fnmatch</code> from the C standard library. The character "*"
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenermatches any sequence of characters, "?" matches any single character,
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerand "[<em>seq</em>]" matches any character in <em>seq</em>. The "/"
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenercharacter will not be matched by any wildcard; it must be specified
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerexplicitly.</p>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<p>If even more flexible matching is required, each
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenercontainer has a regular expression (regex) counterpart <code class="directive"><a href="/mod/core.html#directorymatch"><DirectoryMatch></a></code>, <code class="directive"><a href="/mod/core.html#filesmatch"><FilesMatch></a></code>, and <code class="directive"><a href="/mod/core.html#locationmatch"><LocationMatch></a></code> that allow
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerperl-compatible
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<a class="glossarylink" href="/glossary.html#regex" title="see glossary">regular expressions</a>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerto be used in choosing the matches. But see the section below on
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerconfiguration merging to find out how using regex sections will change
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerhow directives are applied.</p>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<p>A non-regex wildcard section that changes the configuration of
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerall user directories could look as follows:</p>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<Directory /home/*/public_html><br />
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerOptions Indexes<br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</Directory>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<p>Using regex sections, we can deny access to many types of image files
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerat once:</p>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<FilesMatch \.(?i:gif|jpe?g|png)$><br />
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerOrder allow,deny<br />
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerDeny from all<br />
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener</FilesMatch>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<h3><a name="whichwhen" id="whichwhen">What to use When</a></h3>
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovener<p>Choosing between filesystem containers and webspace containers is
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcoveneractually quite easy. When applying directives to objects that reside
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerin the filesystem always use <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> or <code class="directive"><a href="/mod/core.html#files"><Files></a></code>. When applying directives to objects
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenerthat do not reside in the filesystem (such as a webpage generated from
4e9c24785b525d2956e6e381015c0f2bd0a72f4bcovenera database), use <code class="directive"><a href="/mod/core.html#location"><Location></a></code>.</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>It is important to never use <code class="directive"><a href="/mod/core.html#location"><Location></a></code> when trying to restrict
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesaccess to objects in the filesystem. This is because many
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesdifferent webspace locations (URLs) could map to the same filesystem
68d5e906a21c3abe1ebd0da30d2f0e8e4c2ad28cjimlocation, allowing your restrictions to be circumvented.
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesFor example, consider the following configuration:</p>
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<Location /dir/><br />
465bb68501690d7a47bfd2a6129580047d76d8f1rederpjOrder allow,deny<br />
3dfeb02cfb853d8717ca0cc259b59fea610173f5bnicholesDeny from all<br />
465bb68501690d7a47bfd2a6129580047d76d8f1rederpj</Location>
3dfeb02cfb853d8717ca0cc259b59fea610173f5bnicholes<p>This works fine if the request is for
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<code>http://yoursite.example.com/dir/</code>. But what if you are on
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesa case-insensitive filesystem? Then your restriction could be easily
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholescircumvented by requesting
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<code>http://yoursite.example.com/DIR/</code>. The <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> directive, in
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholescontrast, will apply to any content served from that location,
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesregardless of how it is called. (An exception is filesystem links.
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesThe same directory can be placed in more than one part of the
ebe5305f8b22507374358f32b74d12fb50c05a25covenerfilesystem using symbolic links. The <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> directive will follow the symbolic
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholeslink without resetting the pathname. Therefore, for the highest level
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesof security, symbolic links should be disabled with the appropriate
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<code class="directive"><a href="/mod/core.html#options">Options</a></code> directive.)</p>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>If you are, perhaps, thinking that none of this applies to you
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesbecause you use a case-sensitive filesystem, remember that there are
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesmany other ways to map multiple webspace locations to the same
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesfilesystem location. Therefore you should always use the filesystem
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholescontainers when you can. There is, however, one exception to this
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesrule. Putting configuration restrictions in a <code><Location
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes/></code> section is perfectly safe because this section will apply
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesto all requests regardless of the specific URL.</p>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes</div><div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<h2><a name="virtualhost" id="virtualhost">Virtual Hosts</a></h2>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>The <code class="directive"><a href="/mod/core.html#virtualhost"><VirtualHost></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholescontainer encloses directives that apply to specific hosts.
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesThis is useful when serving multiple hosts from the same machine
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholeswith a different configuration for each. For more information,
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholessee the <a href="vhosts/">Virtual Host Documentation</a>.</p>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes</div><div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
ebe5305f8b22507374358f32b74d12fb50c05a25covener<p>The <code class="directive"><a href="/mod/mod_proxy.html#proxy"><Proxy></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesand <code class="directive"><a href="/mod/mod_proxy.html#proxymatch"><ProxyMatch></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholescontainers apply enclosed configuration directives only
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesto sites accessed through <code class="module"><a href="/mod/mod_proxy.html">mod_proxy</a></code>'s proxy server
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesthat match the specified URL. For example, the following configuration
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholeswill prevent the proxy server from being used to access the
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesOrder allow,deny<br />
ebe5305f8b22507374358f32b74d12fb50c05a25covenerDeny from all<br />
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes</Proxy>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes</div><div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<h2><a name="whatwhere" id="whatwhere">What Directives are Allowed?</a></h2>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<p>To find out what directives are allowed in what types of
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesconfiguration sections, check the <a href="mod/directive-dict.html#Context">Context</a> of the directive.
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesEverything that is allowed in
b08925593f214f621161742925dcf074a8047e0acovener<code class="directive"><a href="/mod/core.html#directory"><Directory></a></code>
b08925593f214f621161742925dcf074a8047e0acovenersections is also syntactically allowed in
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<code class="directive"><a href="/mod/core.html#directorymatch"><DirectoryMatch></a></code>,
7add8f7fb048534390571801b7794f71cd9e127abnicholes<code class="directive"><a href="/mod/core.html#files"><Files></a></code>,
7add8f7fb048534390571801b7794f71cd9e127abnicholes<code class="directive"><a href="/mod/core.html#filesmatch"><FilesMatch></a></code>,
8445dae5cc606ba8ba04efc341cc1e081d95920drpluem<code class="directive"><a href="/mod/core.html#location"><Location></a></code>,
8445dae5cc606ba8ba04efc341cc1e081d95920drpluem<code class="directive"><a href="/mod/core.html#locationmatch"><LocationMatch></a></code>,
7add8f7fb048534390571801b7794f71cd9e127abnicholes<code class="directive"><a href="/mod/mod_proxy.html#proxy"><Proxy></a></code>,
7add8f7fb048534390571801b7794f71cd9e127abnicholesand <code class="directive"><a href="/mod/mod_proxy.html#proxymatch"><ProxyMatch></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholessections. There are some exceptions, however:</p>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<li>The <code class="directive"><a href="/mod/core.html#allowoverride">AllowOverride</a></code> directive
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesworks only in <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholessections.</li>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<code>SymLinksIfOwnerMatch</code> <code class="directive"><a href="/mod/core.html#options">Options</a></code> work only in <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> sections or
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<li>The <code class="directive"><a href="/mod/core.html#options">Options</a></code> directive cannot
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesbe used in <code class="directive"><a href="/mod/core.html#files"><Files></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesand <code class="directive"><a href="/mod/core.html#filesmatch"><FilesMatch></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholessections.</li>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes</div><div class="top"><a href="#page-header"><img alt="top" src="/images/up.gif" /></a></div>
7add8f7fb048534390571801b7794f71cd9e127abnicholes<h2><a name="mergin" id="mergin">How the sections are merged</a></h2>
3dfeb02cfb853d8717ca0cc259b59fea610173f5bnicholes<p>The configuration sections are applied in a very particular order.
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesSince this can have important effects on how configuration directives
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholesare interpreted, it is important to understand how this works.</p>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <li> <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> (except regular expressions)
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes and <code>.htaccess</code> done simultaneously (with
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code>)</li>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <li><code class="directive"><a href="/mod/core.html#directorymatch"><DirectoryMatch></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <li><code class="directive"><a href="/mod/core.html#files"><Files></a></code> and <code class="directive"><a href="/mod/core.html#filesmatch"><FilesMatch></a></code> done
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes simultaneously</li>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <li><code class="directive"><a href="/mod/core.html#location"><Location></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes and <code class="directive"><a href="/mod/core.html#locationmatch"><LocationMatch></a></code> done simultaneously</li>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <p>Apart from <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code>, each group is processed in
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes the order that they appear in the configuration files. <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> (group 1 above)
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes is processed in the order shortest directory component to longest.
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes So for example, <code><Directory /var/web/dir></code> will
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes be processed before <code><Directory
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes /var/web/dir/subdir></code>. If multiple <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> sections apply
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes to the same directory they are processed in the configuration file
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes order. Configurations included via the <code class="directive"><a href="/mod/core.html#include">Include</a></code> directive will be treated as if
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes they were inside the including file at the location of the
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <code class="directive"><a href="/mod/core.html#include">Include</a></code> directive.</p>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <p>Sections inside <code class="directive"><a href="/mod/core.html#virtualhost"><VirtualHost></a></code> sections
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes are applied <em>after</em> the corresponding sections outside
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes the virtual host definition. This allows virtual hosts to
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes override the main server configuration.</p>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <p>When the request is served by <code class="module"><a href="/mod/mod_proxy.html">mod_proxy</a></code>, the
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <code class="directive"><a href="/mod/mod_proxy.html#proxy"><Proxy></a></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes container takes the place of the <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> container in the processing
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes There is actually a
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes <code><Location></code>/<code><LocationMatch></code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes sequence performed just before the name translation phase
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes (where <code>Aliases</code> and <code>DocumentRoots</code>
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes are used to map URLs to filenames). The results of this
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes sequence are completely thrown away after the translation has
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<h3><a name="merge-examples" id="merge-examples">Some Examples</a></h3>
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>Below is an artificial example to show the order of
e8f95a682820a599fe41b22977010636be5c2717jimmerging. Assuming they all apply to the request, the directives in
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesthis example will be applied in the order A > B > C > D >
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<Location /><br />
54d22ed1c429b903b029bbd62621f11a9e286137minfrin</Location><br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</Files><br />
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<VirtualHost *><br />
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<Directory /a/b><br />
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes</Directory><br />
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes</VirtualHost><br />
d330a801b1e5d63a4b8b4fd431542ad0903fd71bbnicholes<DirectoryMatch "^.*b$"><br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes</DirectoryMatch><br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<Directory /a/b><br />
54d22ed1c429b903b029bbd62621f11a9e286137minfrin</Directory><br />
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholes<p>For a more concrete example, consider the following. Regardless of
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesany access restrictions placed in <code class="directive"><a href="/mod/core.html#directory"><Directory></a></code> sections, the <code class="directive"><a href="/mod/core.html#location"><Location></a></code> section will be
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesevaluated last and will allow unrestricted access to the server. In
d5b12fe8ae917e654a33247fd4e59dc9e75170aebnicholesother words, order of merging is important, so be careful!</p>
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<Location /><br />
54d22ed1c429b903b029bbd62621f11a9e286137minfrinOrder deny,allow<br />
54d22ed1c429b903b029bbd62621f11a9e286137minfrinAllow from all<br />
54d22ed1c429b903b029bbd62621f11a9e286137minfrin</Location><br />
54d22ed1c429b903b029bbd62621f11a9e286137minfrin# Woops! This <Directory> section will have no effect<br />
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<Directory /><br />
54d22ed1c429b903b029bbd62621f11a9e286137minfrinOrder allow,deny<br />
54d22ed1c429b903b029bbd62621f11a9e286137minfrinAllow from all<br />
482f676c6c19b1c5bb5cca04dad11509c1da3a4cwrowe</Directory>
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<p><span>Available Languages: </span><a href="/en/sections.html" title="English"> en </a> |
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<a href="/ja/sections.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a> |
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<a href="/ko/sections.html" hreflang="ko" rel="alternate" title="Korean"> ko </a> |
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<a href="/tr/sections.html" hreflang="tr" rel="alternate" title="T�rk�e"> tr </a></p>
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<p class="apache">Copyright 2008 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
54d22ed1c429b903b029bbd62621f11a9e286137minfrin<p class="menu"><a href="/mod/">Modules</a> | <a href="/mod/directives.html">Directives</a> | <a href="/faq/">FAQ</a> | <a href="/glossary.html">Glossary</a> | <a href="/sitemap.html">Sitemap</a></p></div>