最後更新: 2024-02-01

目錄

• AllowOverride
• AllowOverrideList
• Disable .htaccess
• 應用: Override "require valid user" in .htaccess

AllowOverride

Types of directives(directive grouping) that are allowed in .htaccess files

 * AllowOverride is valid only in <Directory> sections specified without regular expressions

Context: directory

Directive-type

• All
• None
• AuthConfig
  (AuthGroupFile, AuthName, AuthType, AuthUserFile, Require, etc.)
• FileInfo
  (document types, document meta data, mod_rewrite,  mod_alias, mod_actions ...)
• Indexes ( DirectoryIndex ... )
• Limit (Allow, Deny, Order ...)
• Options (Options, SSLOptions ... )

Example:

# 可以自行設定 rewrite

<Directory /var/www/html>
    AllowOverride FileInfo
</Directory>

List

• https://httpd.apache.org/docs/2.4/mod/overrides.html

For a stricter approach

Set "AllowOverride None" and use AllowOverrideList to specify the exact list of directives that .htaccess users are allowed to use.

AllowOverrideList

Individual directives that are allowed in .htaccess files

 * AllowOverrideList is valid only in <Directory> sections specified without regular expressions

Example:

# Only the Redirect and RedirectMatch directives are allowed

AllowOverride None
AllowOverrideList Redirect RedirectMatch

# Allow mod_rewrite only

AllowOverride None
AllowOverrideList RewriteEngine \
    RewriteBase \
    RewriteCond \
    RewriteRule \
    RewriteOptions

AuthConfig

AuthGroupFile, AuthName, AuthType, AuthUserFile, Require

FileInfo

• document types (ErrorDocument, SetHandler, SetOutputFilter, ...)
• document meta data (Header, SetEnvIf, ...)
• mod_rewrite directives
• mod_alias directives
• mod_actions directives

Indexes

AddDescription, AddIcon, AddIconByEncoding, AddIconByType, DefaultIcon,
DirectoryIndex, FancyIndexing, HeaderName, IndexIgnore, IndexOptions, ReadmeName

Limit

It controlling host access (Allow, Deny and Order)

Options

Disable .htaccess

When AllowOverrideList is set to None and AllowOverride is set to None,
then .htaccess files are completely ignored.

Override "require valid user" in .htaccess

在 .htaccess 加入         # 用 satisfy 實現

Allow from all
satisfy any