Require Rules

Require Rules

Require Rules: users, groups, hosts and expressions

Require names a provider: all, method, env, expr, user, valid-user, group, or ip, host and local (IP and Referrer Checks). Several Require lines act as one <RequireAny>: one grant suffices. <RequireAll> needs every rule to pass, and Require not can only refuse, so it sits in a <RequireAll>. This wiki lets anyone read and editors write, and shuts out one editor:

Public reads, editors write, one editor refusedApache config

# /var/www/example/wiki/.htaccess - Needs: mod_authz_groupfile; AllowOverride AuthConfig
AuthType Basic
AuthName "Wiki"
AuthUserFile /etc/apache2/auth/htpasswd
AuthGroupFile /etc/apache2/auth/groups
<RequireAll>
  <RequireAny>
    Require method GET HEAD OPTIONS
    Require group editors
  </RequireAny>
  Require not user carol
</RequireAll>

The page echoes REQUEST_METHOD and REMOTE_USER. Each line is one curl 3,008 -X request, with or without a login, and its status:

Output of 65

GET         GET as anonymous 200
POST         401
POST alice  POST as alice 200
POST bob     401
POST carol   401
GET  carol  GET as anonymous 200

The last line surprises: Carol sent a login, yet PHP saw no user. The method rule granted, so Apache 129 never checked her password, and Require not user ignores a request with no user; code that trusts REMOTE_USER needs a rule that demands one. Require expr takes <If> expressions (Directives and Containers). A subdirectory's own Require lines replace these unless it sets AuthMerging And.

MENU