1

According to Apache documentation, setting the AllowOverride and AllowOverrideList options to None, will completely ignore .htaccess files. Not even attempt to read them from the filesystem.

I have both of those options set to none but Apache still reads the .htaccess files. I know this because if I put a .htaccess file in with some valid directives it throws a 500 error. Commenting out the directives (essentially an empty .htaccess file) the 500 error is not thrown. So obviously Apache is still reading the .htaccess files.

Apache2 error log (sanitized for public consumption):
[Thu Jul 30 23:36:35.393831 2020] [core:alert] [pid 60903] [client d.d.d.d:10554] /var/www/example/.htaccess: Require not allowed here, referer: http://example.net/

The question is why? What am I missing? How to make it behave according to the documentation? i.e. not even attempt to read the .htaccess files.

Reference: https://httpd.apache.org/docs/2.4/mod/core.html#allowoverride

When this directive is set to None and AllowOverrideList is set to None, .htaccess files are completely ignored. In this case, the server will not even attempt to read .htaccess files in the filesystem.

  • What does the Apache2 error log show when it throws the 500 error? – Tero Kilkanen Jul 31 at 7:37
  • Showing the config file might be useful. – tater Jul 31 at 7:47
  • Apache2 error log shows Sanitized for public consumption... [Thu Jul 30 23:36:35.393831 2020] [core:alert] [pid 60903] [client d.d.d.d:10554] /var/www/example/.htaccess: Require not allowed here, referer: example.net – NOYB Jul 31 at 7:47
  • 1
    What version of Apache 2.4 are you using? – MrWhite Jul 31 at 10:23
  • 1
    Apache/2.4.6 (CentOS) built: Apr 2 2020 – NOYB Jul 31 at 12:05
2

This would appear to be a bug in earlier versions of Apache 2.4 that was reportedly fixed in Apache 2.4.20
https://bz.apache.org/bugzilla/show_bug.cgi?id=58528

The bug would seem to be that when explicitly setting AllowOverrideList None the value is not being correctly reset.

I have verified that I see the same (incorrect) behaviour in Apache 2.4.7

If you have never set AllowOverrideList elsewhere in your server config then you can omit this directive, since the default is None. (When left as default it does appear to be correctly interpreted as per the docs.)

| improve this answer | |
  • 1
    Thanks so much MrWhite. This indeed is the problem. Now there is no more .htaccess access. :) – NOYB Jul 31 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.