Apache <Directory /> setting affecting <Location /server-status>

Question

After studying the documentation I wouldn't expect directives in a <Directory> container affect non-filesystem URLs like /server-status in the following (full) config:

DefaultRuntimeDir /var/run/apache2
PidFile /var/run/apache2/apache2.pid
User www-data
Group www-data
ErrorLog /var/log/apache2/error.log
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
CustomLog /var/log/apache2/other_vhosts_access.log vhost_combined
DocumentRoot /var/www/html

Listen 80

LoadModule mpm_worker_module /usr/lib/apache2/modules/mod_mpm_worker.so
LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so
LoadModule     status_module /usr/lib/apache2/modules/mod_status.so

<Location /server-status>
    SetHandler server-status
</Location>

<Directory />
    Require all denied
</Directory>

Still, if I run Apache/2.4.25 on Debian stretch with this config like

# apache2 -f demo.conf -X

I get

$ curl --head http://localhost/server-status
HTTP/1.1 403 Forbidden

while if I replace denied in the above config with granted, I get

curl --head http://localhost/server-status
HTTP/1.1 200 OK

In other words, the Require directive in the <Directory /> block does affect the reachability of this URL. Which part of the documentation explains this?

Answer 1

You only set a single access control:

<Directory />
    Require all denied
</Directory>

The section on directive merging explains that Directory sections get applied first, before directives in Location sections, regardless of how they are ordered in your httpd.conf.

The behaviour you then see is explained in the AuthMerging Directive:

When authorization is enabled, it is normally inherited by each subsequent configuration section, unless a different set of authorization directives is specified. This is the default action...

You don't set any additional access controls in the <Location /server-status> configuration section that would override the only access control you did set, the Require all denied and that is the access control that gets inherited by the mod-status module in the /server-status webspace.

Answer 2

As @ezra-s emphasized on IRC, even for purely virtual URIs (like /server-status in the example config in the question) Apache tries to match the leading part (/ in this case) with the filesystem. For absolute URIs the leading / will always match the DocumentRoot, but further path components may match as well, if they happen to exist under DocumentRoot. We can replace the <Location /server-status> and <Directory /> sections of the config in the question by the following to demonstrate this:

<Location /foo/server-status>
    SetHandler server-status
</Location>

<Location /bar/server-status>
    SetHandler server-status
</Location>

<Directory />
    Require all denied
</Directory>

# The /var/www/html/foo directory exists, this makes /foo/server-status accessible:
<Directory /var/www/html/foo>
    Require all granted
</Directory>

# The /var/www/html/bar directory does not exist, this does not make /bar/server-status accessible:
<Directory /var/www/html/bar>
    Require all granted
</Directory>

# But this helps regardless (through another means):
<Location /bar>
    Require all granted
</Location>

So this is how virtual locations get affected by <Directory> blocks.