Apache “Order” directive

Question

Quite often I see directives like

Order allow,deny
Allow from all

As far as I understand it, this order would give access to everybody. I find that irritating since I think that this is the same as:

Order deny,allow

This one first checks deny lines, then allow lines and defaults to allow. So basically the first order can be rewritten in order to save one line. Are those two orders the same or will they behave differently?

The opposite should work too: In order to deny access to everybody, you can rewrite

Order deny,allow
deny from all

to

Order allow,deny

Is that correct?

Answer 1

You're correct. As you can see in Apache documentation the allowing order is slightly different than other systems (e.g. iptables) as the last match is what gets applied.

So you are right that they are equivalent, but because is the common practice usually is easier to maintain because is what you are used to, but there's no reason why you could not do it as you suggest.

When you specify Order Deny, Allow it will evaluate all the Deny rules, then all the Allow and if the request does not match any rule it will be accepted. On the opposite side if you specify Order Allow, Deny first it will evaluate all the Allow rules, then all the Deny and if the request doesn't match any rule it will be denied.

Answer 2

The order depends on what you want really,

Say:

1) You need everyone to access your website but then later you decide everyone except one or a very few host need to access your website then -

Order allow,deny
Allow from all
Deny from excepthost.com 

2) If you don't want anyone but a very closed group of clients to access then -

Order deny,allow
deny from all
allow from excepthost.com