After studying the documentation I wouldn't expect directives in a <Directory>
container affect non-filesystem URLs like /server-status
in the following (full) config:
DefaultRuntimeDir /var/run/apache2
PidFile /var/run/apache2/apache2.pid
User www-data
Group www-data
ErrorLog /var/log/apache2/error.log
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
CustomLog /var/log/apache2/other_vhosts_access.log vhost_combined
DocumentRoot /var/www/html
Listen 80
LoadModule mpm_worker_module /usr/lib/apache2/modules/mod_mpm_worker.so
LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so
LoadModule status_module /usr/lib/apache2/modules/mod_status.so
<Location /server-status>
SetHandler server-status
</Location>
<Directory />
Require all denied
</Directory>
Still, if I run Apache/2.4.25 on Debian stretch with this config like
# apache2 -f demo.conf -X
I get
$ curl --head http://localhost/server-status
HTTP/1.1 403 Forbidden
while if I replace denied
in the above config with granted
, I get
curl --head http://localhost/server-status
HTTP/1.1 200 OK
In other words, the Require
directive in the <Directory />
block does affect the reachability of this URL. Which part of the documentation explains this?