The Directory/Location Context Model & .htaccess In Depth

Web Servers Fundamentals Chapter 3 introduced .htaccess conceptually: a per-directory override file, checked on every request, with a real filesystem-scan cost in exchange for letting someone without access to the main config make changes. This chapter goes deep on the two things that actually determine what a given .htaccess file can do and how it interacts with everything else: AllowOverride's real granularity, and the actual merge order across every context type Apache supports.

AllowOverride: What .htaccess Is Actually Allowed to Touch

AllowOverride is not just an on/off switch — it names exactly which groups of directives a .htaccess file in that directory is permitted to set. None disables .htaccess checking entirely for that directory tree (and is the real fix for Fundamentals' own filesystem-scan cost, since Apache then knows not to look at all). All permits every group — broad and rarely the right default. In between, five named groups exist: AuthConfig (authentication directives — AuthType, AuthName, Require), FileInfo (ErrorDocument, and — notably — every mod_rewrite directive), Indexes (IndexOptions, DirectoryIndex, IndexIgnore), Limit (Require/Order/Allow/Deny access-control directives), and Options[=...] (the Options directive itself).

The Real Merge Order: Directory → .htaccess → Files → Location

Apache applies contexts in a fixed order, and later contexts can override directives set by earlier ones — but this is a merge, not a wholesale replacement. Directives a later context doesn't mention still carry over from the broader context that set them. The real order: (1) the main server config and any matching <VirtualHost>, (2) every <Directory> block that matches the requested path, evaluated from the least specific path to the most specific, followed by that most specific directory's own .htaccess file (if AllowOverride permits it), (3) <Files>/<FilesMatch>, and finally (4) <Location>/<LocationMatch>.

A request under /private merges both blocks: the more specific /private context isn't a full replacement of the parent, so FollowSymLinks is still inherited from the parent since /private never mentions it — only Indexes is actually touched, and the leading - means "remove this specific option," not "replace the whole Options list." The end result for /private is FollowSymLinks on, Indexes off, plus the new IP restriction — a genuine merge across two contexts, not the child context overwriting the parent's settings wholesale.

A Worked .htaccess Example

This one file actually needs two separate AllowOverride groups to work at all: Options (for the Options -Indexes line) and FileInfo (which covers both ErrorDocument and every mod_rewrite directive, including RewriteEngine and RewriteRule). A directory whose AllowOverride is set to just AuthConfig would reject every line in this file.

Hands-On Exercises