1

According to Apache documentation, setting the AllowOverride and AllowOverrideList options to None, will completely ignore .htaccess files. Not even attempt to read them from the filesystem.

I have both of those options set to none but Apache still reads the .htaccess files. I know this because if I put a .htaccess file in with some valid directives it throws a 500 error. Commenting out the directives (essentially an empty .htaccess file) the 500 error is not thrown. So obviously Apache is still reading the .htaccess files.

Apache2 error log (sanitized for public consumption):
[Thu Jul 30 23:36:35.393831 2020] [core:alert] [pid 60903] [client d.d.d.d:10554] /var/www/example/.htaccess: Require not allowed here, referer: http://example.net/

The question is why? What am I missing? How to make it behave according to the documentation? i.e. not even attempt to read the .htaccess files.

Reference: https://httpd.apache.org/docs/2.4/mod/core.html#allowoverride

When this directive is set to None and AllowOverrideList is set to None, .htaccess files are completely ignored. In this case, the server will not even attempt to read .htaccess files in the filesystem.

5
  • What does the Apache2 error log show when it throws the 500 error? Jul 31 '20 at 7:37
  • Showing the config file might be useful.
    – tater
    Jul 31 '20 at 7:47
  • Apache2 error log shows Sanitized for public consumption... [Thu Jul 30 23:36:35.393831 2020] [core:alert] [pid 60903] [client d.d.d.d:10554] /var/www/example/.htaccess: Require not allowed here, referer: example.net
    – NOYB
    Jul 31 '20 at 7:47
  • 1
    What version of Apache 2.4 are you using?
    – MrWhite
    Jul 31 '20 at 10:23
  • 1
    Apache/2.4.6 (CentOS) built: Apr 2 2020
    – NOYB
    Jul 31 '20 at 12:05
2

This would appear to be a bug in earlier versions of Apache 2.4 that was reportedly fixed in Apache 2.4.20
https://bz.apache.org/bugzilla/show_bug.cgi?id=58528

The bug would seem to be that when explicitly setting AllowOverrideList None the value is not being correctly reset.

I have verified that I see the same (incorrect) behaviour in Apache 2.4.7

If you have never set AllowOverrideList elsewhere in your server config then you can omit this directive, since the default is None. (When left as default it does appear to be correctly interpreted as per the docs.)

1
  • 1
    Thanks so much MrWhite. This indeed is the problem. Now there is no more .htaccess access. :)
    – NOYB
    Jul 31 '20 at 12:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.