1 <?xml version="1.0" encoding="UTF-8" ?>
2 <!DOCTYPE manualpage SYSTEM "./style/manualpage.dtd">
3 <?xml-stylesheet type="text/xsl" href="./style/manual.en.xsl"?>
4 <!-- $LastChangedRevision$ -->
7 Licensed to the Apache Software Foundation (ASF) under one or more
8 contributor license agreements. See the NOTICE file distributed with
9 this work for additional information regarding copyright ownership.
10 The ASF licenses this file to You under the Apache License, Version 2.0
11 (the "License"); you may not use this file except in compliance with
12 the License. You may obtain a copy of the License at
14 http://www.apache.org/licenses/LICENSE-2.0
16 Unless required by applicable law or agreed to in writing, software
17 distributed under the License is distributed on an "AS IS" BASIS,
18 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19 See the License for the specific language governing permissions and
20 limitations under the License.
23 <manualpage metafile="sections.xml.meta">
25 <title>Configuration Sections</title>
27 <summary> <p>Directives in the <a
28 href="configuring.html">configuration files</a> may apply to the
29 entire server, or they may be restricted to apply only to particular
30 directories, files, hosts, or URLs. This document describes how to
31 use configuration section containers or <code>.htaccess</code> files
32 to change the scope of other configuration directives.</p>
35 <section id="types"><title>Types of Configuration Section Containers</title>
40 <module>mod_version</module>
41 <module>mod_proxy</module>
44 <directive type="section" module="core">Directory</directive>
45 <directive type="section" module="core">DirectoryMatch</directive>
46 <directive type="section" module="core">Files</directive>
47 <directive type="section" module="core">FilesMatch</directive>
48 <directive type="section" module="core">If</directive>
49 <directive type="section" module="core">IfDefine</directive>
50 <directive type="section" module="core">IfModule</directive>
51 <directive type="section" module="mod_version">IfVersion</directive>
52 <directive type="section" module="core">Location</directive>
53 <directive type="section" module="core">LocationMatch</directive>
54 <directive type="section" module="md">MangedDomain</directive>
55 <directive type="section" module="mod_proxy">Proxy</directive>
56 <directive type="section" module="mod_proxy">ProxyMatch</directive>
57 <directive type="section" module="ssl">SSLPolicy</directive>
58 <directive type="section" module="core">VirtualHost</directive>
62 <p>There are two basic types of containers. Most containers are
63 evaluated for each request. The enclosed directives are applied only
64 for those requests that match the containers. The <directive
65 type="section" module="core">IfDefine</directive>, <directive
66 type="section" module="core">IfModule</directive>, and
67 <directive type="section" module="mod_version">IfVersion</directive>
68 containers, on the other hand, are evaluated only at server startup
69 and restart. If their conditions are true at startup, then the
70 enclosed directives will apply to all requests. If the conditions are
71 not true, the enclosed directives will be ignored.</p>
73 <p>The <directive type="section" module="core">IfDefine</directive> directive
74 encloses directives that will only be applied if an appropriate
75 parameter is defined on the <program>httpd</program> command line. For example,
76 with the following configuration, all requests will be redirected
77 to another site only if the server is started using
78 <code>httpd -DClosedForNow</code>:</p>
80 <highlight language="config">
81 <IfDefine ClosedForNow>
82 Redirect "/" "http://otherserver.example.com/"
86 <p>The <directive type="section" module="core">IfModule</directive>
87 directive is very similar, except it encloses directives that will
88 only be applied if a particular module is available in the server.
89 The module must either be statically compiled in the server, or it
90 must be dynamically compiled and its <directive
91 module="mod_so">LoadModule</directive> line must be earlier in the
92 configuration file. This directive should only be used if you need
93 your configuration file to work whether or not certain modules are
94 installed. It should not be used to enclose directives that you want
95 to work all the time, because it can suppress useful error messages
96 about missing modules.</p>
98 <p>In the following example, the <directive
99 module="mod_mime_magic">MimeMagicFile</directive> directive will be
100 applied only if <module>mod_mime_magic</module> is available.</p>
102 <highlight language="config">
103 <IfModule mod_mime_magic.c>
104 MimeMagicFile conf/magic
108 <p>The <directive type="section" module="mod_version">IfVersion</directive>
109 directive is very similar to <directive type="section"
110 module="core">IfDefine</directive> and <directive type="section"
111 module="core">IfModule</directive>, except it encloses directives that will
112 only be applied if a particular version of the server is executing. This
113 module is designed for the use in test suites and large networks which have to
114 deal with different httpd versions and different configurations.</p>
116 <highlight language="config">
117 <IfVersion >= 2.4>
118 # this happens only in versions greater or
123 <p><directive type="section" module="core">IfDefine</directive>,
124 <directive type="section" module="core">IfModule</directive>, and the
125 <directive type="section" module="mod_version">IfVersion</directive>
126 can apply negative conditions by preceding their test with "!".
127 Also, these sections can be nested to achieve more complex
131 <section id="file-and-web"><title>Filesystem, Webspace, and Boolean Expressions</title>
133 <p>The most commonly used configuration section containers are the
134 ones that change the configuration of particular places in the
135 filesystem or webspace. First, it is important to understand the
136 difference between the two. The filesystem is the view of your disks
137 as seen by your operating system. For example, in a default install,
138 Apache httpd resides at <code>/usr/local/apache2</code> in the Unix
139 filesystem or <code>"c:/Program Files/Apache Group/Apache2"</code> in
140 the Windows filesystem. (Note that forward slashes should always be
141 used as the path separator in Apache httpd configuration files, even for Windows.) In contrast,
142 the webspace is the view of your site as delivered by the web server
143 and seen by the client. So the path <code>/dir/</code> in the
144 webspace corresponds to the path
145 <code>/usr/local/apache2/htdocs/dir/</code> in the filesystem of a
146 default Apache httpd install on Unix. The webspace need not map directly to
147 the filesystem, since webpages may be generated dynamically
148 from databases or other locations.</p>
150 <section id="filesystem"><title>Filesystem Containers</title>
152 <p>The <directive type="section" module="core">Directory</directive>
153 and <directive type="section" module="core">Files</directive>
154 directives, along with their <glossary ref="regex">regex</glossary>
155 counterparts, apply directives to
156 parts of the filesystem. Directives enclosed in a <directive
157 type="section" module="core">Directory</directive> section apply to
158 the named filesystem directory and all subdirectories of that
159 directory (as well as the files in those directories).
160 The same effect can be obtained using <a
161 href="howto/htaccess.html">.htaccess files</a>. For example, in the
162 following configuration, directory indexes will be enabled for the
163 <code>/var/web/dir1</code> directory and all subdirectories.</p>
165 <highlight language="config">
166 <Directory "/var/web/dir1">
171 <p>Directives enclosed in a <directive type="section"
172 module="core">Files</directive> section apply to any file with
173 the specified name, regardless of what directory it lies in.
174 So for example, the following configuration directives will,
175 when placed in the main section of the configuration file,
176 deny access to any file named <code>private.html</code> regardless
177 of where it is found.</p>
179 <highlight language="config">
180 <Files "private.html">
185 <p>To address files found in a particular part of the filesystem, the
186 <directive type="section" module="core">Files</directive> and
187 <directive type="section" module="core">Directory</directive> sections
188 can be combined. For example, the following configuration will deny
189 access to <code>/var/web/dir1/private.html</code>,
190 <code>/var/web/dir1/subdir2/private.html</code>,
191 <code>/var/web/dir1/subdir3/private.html</code>, and any other instance
192 of <code>private.html</code> found under the <code>/var/web/dir1/</code>
195 <highlight language="config">
196 <Directory "/var/web/dir1">
197 <Files "private.html">
204 <section id="webspace"><title>Webspace Containers</title>
206 <p>The <directive type="section" module="core">Location</directive>
207 directive and its <glossary ref="regex">regex</glossary> counterpart, on
208 the other hand, change the
209 configuration for content in the webspace. For example, the following
210 configuration prevents access to any URL-path that begins in /private.
211 In particular, it will apply to requests for
212 <code>http://yoursite.example.com/private</code>,
213 <code>http://yoursite.example.com/private123</code>, and
214 <code>http://yoursite.example.com/private/dir/file.html</code> as well
215 as any other requests starting with the <code>/private</code> string.</p>
217 <highlight language="config">
218 <LocationMatch "^/private">
220 </LocationMatch>
223 <p>The <directive type="section" module="core">Location</directive>
224 directive need not have anything to do with the filesystem.
225 For example, the following example shows how to map a particular
226 URL to an internal Apache HTTP Server handler provided by <module>mod_status</module>.
227 No file called <code>server-status</code> needs to exist in the
230 <highlight language="config">
231 <Location "/server-status">
232 SetHandler server-status
237 <section id="overlapping-webspace"><title>Overlapping Webspace</title>
238 <p>In order to have two overlapping URLs one has to consider the order in which
239 certain sections or directives are evaluated. For
240 <directive type="section" module="core">Location</directive> this would be:</p>
241 <highlight language="config">
242 <Location "/foo">
244 <Location "/foo/bar">
247 <p><directive type="section" module="mod_alias">Alias</directive>es on the other hand,
248 are mapped vice-versa:</p>
249 <highlight language="config">
250 Alias "/foo/bar" "/srv/www/uncommon/bar"
251 Alias "/foo" "/srv/www/common/foo"
253 <p>The same is true for the <directive module="mod_proxy">ProxyPass</directive>
255 <highlight language="config">
256 ProxyPass "/special-area" "http://special.example.com" smax=5 max=10
257 ProxyPass "/" "balancer://mycluster/" stickysession=JSESSIONID|jsessionid nofailover=On
261 <section id="wildcards"><title>Wildcards and Regular Expressions</title>
263 <p>The <directive type="section" module="core">Directory</directive>,
264 <directive type="section" module="core">Files</directive>, and
265 <directive type="section" module="core">Location</directive>
266 directives can each use shell-style wildcard characters as in
267 <code>fnmatch</code> from the C standard library. The character "*"
268 matches any sequence of characters, "?" matches any single character,
269 and "[<em>seq</em>]" matches any character in <em>seq</em>. The "/"
270 character will not be matched by any wildcard; it must be specified
273 <p>If even more flexible matching is required, each
274 container has a regular expression (regex) counterpart <directive
275 type="section" module="core">DirectoryMatch</directive>, <directive
276 type="section" module="core">FilesMatch</directive>, and <directive
277 type="section" module="core">LocationMatch</directive> that allow
279 <glossary ref="regex">regular expressions</glossary>
280 to be used in choosing the matches. But see the section below on
281 configuration merging to find out how using regex sections will change
282 how directives are applied.</p>
284 <p>A non-regex wildcard section that changes the configuration of
285 all user directories could look as follows:</p>
287 <highlight language="config">
288 <Directory "/home/*/public_html">
293 <p>Using regex sections, we can deny access to many types of image files
295 <highlight language="config">
296 <FilesMatch "\.(?i:gif|jpe?g|png)$">
301 <p>Regular expressions containing <strong>named groups and
302 backreferences</strong> are added to the environment with the
303 corresponding name in uppercase. This allows elements of filename paths
304 and URLs to be referenced from within <a href="expr.html">expressions</a>
305 and modules like <module>mod_rewrite</module>.</p>
307 <highlight language="config">
308 <DirectoryMatch "^/var/www/combined/(?<SITENAME>[^/]+)">
309 require ldap-group cn=%{env:MATCH_SITENAME},ou=combined,o=Example
310 </DirectoryMatch>
315 <section id="expressions"><title>Boolean expressions</title>
316 <p>The <directive type="section" module="core">If</directive>
317 directive change the configuration depending on a condition which can be
318 expressed by a boolean expression. For example, the following configuration
319 denies access if the HTTP Referer header does not start with
320 "http://www.example.com/".</p>
321 <highlight language="config">
322 <If "!(%{HTTP_REFERER} -strmatch 'http://www.example.com/*')">
329 <section id="whichwhen"><title>What to use When</title>
331 <p>Choosing between filesystem containers and webspace containers is
332 actually quite easy. When applying directives to objects that reside
333 in the filesystem always use <directive type="section"
334 module="core">Directory</directive> or <directive type="section"
335 module="core">Files</directive>. When applying directives to objects
336 that do not reside in the filesystem (such as a webpage generated from
337 a database), use <directive type="section"
338 module="core">Location</directive>.</p>
340 <p>It is important to never use <directive type="section"
341 module="core">Location</directive> when trying to restrict
342 access to objects in the filesystem. This is because many
343 different webspace locations (URLs) could map to the same filesystem
344 location, allowing your restrictions to be circumvented.
345 For example, consider the following configuration:</p>
347 <highlight language="config">
348 <Location "/dir/">
353 <p>This works fine if the request is for
354 <code>http://yoursite.example.com/dir/</code>. But what if you are on
355 a case-insensitive filesystem? Then your restriction could be easily
356 circumvented by requesting
357 <code>http://yoursite.example.com/DIR/</code>. The <directive
358 type="section" module="core">Directory</directive> directive, in
359 contrast, will apply to any content served from that location,
360 regardless of how it is called. (An exception is filesystem links.
361 The same directory can be placed in more than one part of the
362 filesystem using symbolic links. The <directive type="section"
363 module="core">Directory</directive> directive will follow the symbolic
364 link without resetting the pathname. Therefore, for the highest level
365 of security, symbolic links should be disabled with the appropriate
366 <directive module="core">Options</directive> directive.)</p>
368 <p>If you are, perhaps, thinking that none of this applies to you
369 because you use a case-sensitive filesystem, remember that there are
370 many other ways to map multiple webspace locations to the same
371 filesystem location. Therefore you should always use the filesystem
372 containers when you can. There is, however, one exception to this
373 rule. Putting configuration restrictions in a <code><Location
374 "/"></code> section is perfectly safe because this section will apply
375 to all requests regardless of the specific URL.</p>
378 <section id="nesting"><title>Nesting of sections</title>
380 <p>Some section types can be nested inside other section types. On the one
381 hand, <directive type="section" module="core">Files</directive> can be used
382 inside <directive type="section" module="core">Directory</directive>. On
383 the other hand, <directive type="section" module="core">If</directive> can
384 be used inside <directive type="section" module="core">Directory</directive>,
385 <directive type="section" module="core">Location</directive>, and <directive
386 type="section" module="core">Files</directive> sections (but not inside another
387 <directive type="section" module="core">If</directive>). The regex
388 counterparts of the named section behave identically.</p>
390 <p>Nested sections are merged after non-nested sections of the same type.</p>
396 <section id="virtualhost"><title>Virtual Hosts</title>
398 <p>The <directive type="section" module="core">VirtualHost</directive>
399 container encloses directives that apply to specific hosts.
400 This is useful when serving multiple hosts from the same machine
401 with a different configuration for each. For more information,
402 see the <a href="vhosts/">Virtual Host Documentation</a>.</p>
405 <section id="proxy"><title>Proxy</title>
407 <p>The <directive type="section" module="mod_proxy">Proxy</directive>
408 and <directive type="section" module="mod_proxy">ProxyMatch</directive>
409 containers apply enclosed configuration directives only
410 to sites accessed through <module>mod_proxy</module>'s proxy server
411 that match the specified URL. For example, the following configuration
412 will allow only a subset of clients to access the
413 <code>www.example.com</code> website using the proxy server:</p>
415 <highlight language="config">
416 <Proxy http://www.example.com/*>
417 Require host yournetwork.example.com
422 <section id="whatwhere"><title>What Directives are Allowed?</title>
424 <p>To find out what directives are allowed in what types of
425 configuration sections, check the <a
426 href="mod/directive-dict.html#Context">Context</a> of the directive.
427 Everything that is allowed in
428 <directive type="section" module="core">Directory</directive>
429 sections is also syntactically allowed in
430 <directive type="section" module="core">DirectoryMatch</directive>,
431 <directive type="section" module="core">Files</directive>,
432 <directive type="section" module="core">FilesMatch</directive>,
433 <directive type="section" module="core">Location</directive>,
434 <directive type="section" module="core">LocationMatch</directive>,
435 <directive type="section" module="mod_proxy">Proxy</directive>,
436 and <directive type="section" module="mod_proxy">ProxyMatch</directive>
437 sections. There are some exceptions, however:</p>
440 <li>The <directive module="core">AllowOverride</directive> directive
441 works only in <directive type="section" module="core">Directory</directive>
444 <li>The <code>FollowSymLinks</code> and
445 <code>SymLinksIfOwnerMatch</code> <directive
446 module="core">Options</directive> work only in <directive
447 type="section" module="core">Directory</directive> sections or
448 <code>.htaccess</code> files.</li>
450 <li>The <directive module="core">Options</directive> directive cannot
451 be used in <directive type="section" module="core">Files</directive>
452 and <directive type="section" module="core">FilesMatch</directive>
457 <section id="merging"><title>How the sections are merged</title>
459 <p>The configuration sections are applied in a very particular order.
460 Since this can have important effects on how configuration directives
461 are interpreted, it is important to understand how this works.</p>
463 <p>The order of merging is:</p>
466 <li> <directive type="section"
467 module="core">Directory</directive> (except regular expressions)
468 and <code>.htaccess</code> done simultaneously (with
469 <code>.htaccess</code>, if allowed, overriding
470 <directive type="section" module="core">Directory</directive>)</li>
472 <li><directive type="section" module="core">DirectoryMatch</directive>
473 (and <code><Directory ~></code>)</li>
475 <li><directive type="section"
476 module="core">Files</directive> and <directive
477 type="section" module="core">FilesMatch</directive> done
480 <li><directive type="section" module="core">Location</directive>
481 and <directive type="section"
482 module="core">LocationMatch</directive> done simultaneously</li>
484 <li><directive type="section" module="core">If</directive>
489 <p>Some important remarks:</p>
491 <li>Apart from <directive type="section"
492 module="core">Directory</directive>, within each group the sections are
493 processed in the order they appear in the configuration files.
494 For example, a request for <em>/foo</em> will match
495 <code><Location "/foo/bar"></code> and
496 <code><Location "/foo"></code> (group 4 in this case):
497 both sections will be evaluated
498 but in the order they appear in the configuration files.</li>
499 <li><directive type="section" module="core">Directory</directive>
500 (group 1 above) is processed in the order shortest directory
501 component to longest. For example,
502 <code><Directory "/var/web/dir"></code> will be processed before
503 <code><Directory "/var/web/dir/subdir"></code>.</li>
504 <li>If multiple <directive
505 type="section" module="core">Directory</directive> sections apply
506 to the same directory they are processed in the configuration file
508 <li>Configurations included via the <directive
509 module="core">Include</directive> directive will be treated as if
510 they were inside the including file at the location of the
511 <directive module="core">Include</directive> directive.</li>
512 <li>Sections inside <directive type="section"
513 module="core">VirtualHost</directive> sections
514 are applied <em>after</em> the corresponding sections outside
515 the virtual host definition. This allows virtual hosts to
516 override the main server configuration.</li>
517 <li>When the request is served by <module>mod_proxy</module>, the
518 <directive module="mod_proxy" type="section">Proxy</directive>
519 container takes the place of the <directive module="core"
520 type="section">Directory</directive> container in the processing
524 <note><title>Technical Note</title>
526 <code><Location></code>/<code><LocationMatch></code>
527 sequence performed just before the name translation phase
528 (where <code>Aliases</code> and <code>DocumentRoots</code>
529 are used to map URLs to filenames). The results of this
530 sequence are completely thrown away after the translation has
534 <section id="relationship-module-configuration"><title>Relationship between modules and configuration sections</title>
535 <p>One question that often arises after reading how configuration sections are
536 merged is related to how and when directives of specific modules like <module>mod_rewrite</module>
537 are processed. The answer is not trivial and needs a bit of background.
538 Each httpd module manages its own configuration, and each of its directives in httpd.conf specify one piece
539 of configuration in a particular context. httpd does not execute a command as it is read.</p>
540 <p>At runtime, the core of httpd iterates over the defined configuration sections in the order
541 described above to determine which ones apply to the current request. When the first section matches,
542 it is considered the current configuration for this request. If a subsequent section matches too,
543 then each module with a directive in either of the sections is given a chance to merge its configuration between the two sections. The result is a third configuration, and the process goes on until all the configuration sections
545 <p>After the above step, the "real" processing of the HTTP request begins: each module has a chance to run
546 and perform whatever tasks they like. They can retrieve their own final merged configuration from the core
547 of the httpd to determine how they should act.</p>
548 <p>An example can help to visualize the whole process. The following configuration uses the
549 <directive module="mod_headers">Header</directive> directive of <module>mod_headers</module> to set
550 a specific HTTP header. What value will httpd set in the <code>CustomHeaderName</code> header for a request to
551 <code>/example/index.html</code> ?
553 <highlight language="config">
555 <Directory "/">
556 Header set CustomHeaderName one
557 <FilesMatch ".*">
558 Header set CustomHeaderName three
562 <Directory "/example">
563 Header set CustomHeaderName two
568 <li><directive>Directory</directive> "/" matches and an initial configuration to set the <code>CustomHeaderName</code> header with the value <code>one</code> is created.</li>
569 <li><directive>Directory</directive> "/example" matches, and since <module>mod_headers</module> specifies in its code to override in case of a merge, a new configuration is created to set the <code>CustomHeaderName</code> header with the value <code>two</code>.</li>
570 <li><directive>FilesMatch</directive> ".*" matches and another merge opportunity arises, causing the <code>CustomHeaderName</code> header to be set with the value <code>three</code>.</li>
571 <li>Eventually during the next steps of the HTTP request processing <module>mod_headers</module> will be called and it will receive the configuration to set the <code>CustomHeaderName</code> header with the value <code>three</code>. <module>mod_headers</module> normally uses this configuration to perfom its job, namely setting the foo header. This does not mean that a module can't perform a more complex action like discarding directives because not needed or deprecated, etc..</li>
574 <p>This is true for .htaccess too since they have the same priority as <directive>Directory</directive> in the merge order. The important concept to understand is that configuration sections like <directive>Directory</directive> and <directive>FilesMatch</directive> are not comparable to module specific directives like <directive module="mod_headers">Header</directive> or <directive module="mod_rewrite">RewriteRule</directive> because they operate on different levels.
578 <section id="merge-examples"><title>Some useful examples</title>
580 <p>Below is an artificial example to show the order of
581 merging. Assuming they all apply to the request, the directives in
582 this example will be applied in the order A > B > C > D >
585 <highlight language="config">
590 <Files "f.html">
594 <VirtualHost *>
595 <Directory "/a/">
600 <DirectoryMatch "^.*b$">
602 </DirectoryMatch>
604 <Directory "/a/b">
611 <p>For a more concrete example, consider the following. Regardless of
612 any access restrictions placed in <directive module="core"
613 type="section">Directory</directive> sections, the <directive
614 module="core" type="section">Location</directive> section will be
615 evaluated last and will allow unrestricted access to the server. In
616 other words, order of merging is important, so be careful!</p>
618 <highlight language="config">
623 # Whoops! This <Directory> section will have no effect
624 <Directory "/">
627 Require not host badguy.example.com