1 <?xml version="1.0" encoding="ISO-8859-1"?>
2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
3 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><!--
4 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
5 This file is generated from xml source: DO NOT EDIT
6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
8 <title>mod_access - Apache HTTP Server</title>
9 <link href="../style/css/manual.css" rel="stylesheet" media="all" type="text/css" title="Main stylesheet" />
10 <link href="../style/css/manual-loose-100pc.css" rel="alternate stylesheet" media="all" type="text/css" title="No Sidebar - Default font size" />
11 <link href="../style/css/manual-print.css" rel="stylesheet" media="print" type="text/css" />
12 <link href="../images/favicon.ico" rel="shortcut icon" /></head>
14 <div id="page-header">
15 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p>
16 <p class="apache">Apache HTTP Server Version 2.0</p>
17 <img alt="" src="../images/feather.gif" /></div>
18 <div class="up"><a href="./"><img title="<-" alt="<-" src="../images/left.gif" /></a></div>
20 <a href="http://www.apache.org/">Apache</a> > <a href="http://httpd.apache.org/">HTTP Server</a> > <a href="http://httpd.apache.org/docs/">Documentation</a> > <a href="../">Version 2.0</a> > <a href="./">Modules</a></div>
21 <div id="page-content">
22 <div id="preamble"><h1>Apache Module mod_access</h1>
24 <p><span>Available Languages: </span><a href="../en/mod/mod_access.html" title="English"> en </a> |
25 <a href="../ja/mod/mod_access.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a></p>
27 <table class="module"><tr><th><a href="module-dict.html#Description">Description:</a></th><td>Provides access control based on client hostname, IP
28 address, or other characteristics of the client request.</td></tr>
29 <tr><th><a href="module-dict.html#Status">Status:</a></th><td>Base</td></tr>
30 <tr><th><a href="module-dict.html#ModuleIdentifier">Module Identifier:</a></th><td>access_module</td></tr>
31 <tr><th><a href="module-dict.html#SourceFile">Source File:</a></th><td>mod_access.c</td></tr>
32 <tr><th><a href="module-dict.html#Compatibility">Compatibility:</a></th><td>Available only in versions prior to 2.1</td></tr></table>
35 <p>The directives provided by <code class="module"><a href="../mod/mod_access.html">mod_access</a></code> are used
36 in <code class="directive"><a href="../mod/core.html#directory"><Directory></a></code>,
37 <code class="directive"><a href="../mod/core.html#files"><Files></a></code>, and
38 <code class="directive"><a href="../mod/core.html#location"><Location></a></code> sections
39 as well as <code><a href="core.html#accessfilename">.htaccess</a></code>
40 files to control access to particular parts of the server. Access
41 can be controlled based on the client hostname, IP address, or
42 other characteristics of the client request, as captured in <a href="../env.html">environment variables</a>. The <code class="directive"><a href="#allow">Allow</a></code> and <code class="directive"><a href="#deny">Deny</a></code> directives are used to
43 specify which clients are or are not allowed access to the server,
44 while the <code class="directive"><a href="#order">Order</a></code>
45 directive sets the default access state, and configures how the
46 <code class="directive"><a href="#allow">Allow</a></code> and <code class="directive"><a href="#deny">Deny</a></code> directives interact with each
49 <p>Both host-based access restrictions and password-based
50 authentication may be implemented simultaneously. In that case,
51 the <code class="directive"><a href="../mod/core.html#satisfy">Satisfy</a></code> directive is used
52 to determine how the two sets of restrictions interact.</p>
54 <p>In general, access restriction directives apply to all
55 access methods (<code>GET</code>, <code>PUT</code>,
56 <code>POST</code>, etc). This is the desired behavior in most
57 cases. However, it is possible to restrict some methods, while
58 leaving other methods unrestricted, by enclosing the directives
59 in a <code class="directive"><a href="../mod/core.html#limit"><Limit></a></code> section.</p>
61 <div id="quickview"><h3 class="directives">Directives</h3>
63 <li><img alt="" src="../images/down.gif" /> <a href="#allow">Allow</a></li>
64 <li><img alt="" src="../images/down.gif" /> <a href="#deny">Deny</a></li>
65 <li><img alt="" src="../images/down.gif" /> <a href="#order">Order</a></li>
69 <li><code class="directive"><a href="../mod/core.html#satisfy">Satisfy</a></code></li>
70 <li><code class="directive"><a href="../mod/core.html#require">Require</a></code></li>
73 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
74 <div class="directive-section"><h2><a name="Allow" id="Allow">Allow</a> <a name="allow" id="allow">Directive</a></h2>
75 <table class="directive">
76 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Controls which hosts can access an area of the
78 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code> Allow from
79 all|<var>host</var>|env=<var>env-variable</var>
80 [<var>host</var>|env=<var>env-variable</var>] ...</code></td></tr>
81 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
82 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Limit</td></tr>
83 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
84 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_access</td></tr>
87 <p>The <code class="directive">Allow</code> directive affects which hosts can
88 access an area of the server. Access can be controlled by
89 hostname, IP address, IP address range, or by other
90 characteristics of the client request captured in environment
93 <p>The first argument to this directive is always
94 <code>from</code>. The subsequent arguments can take three
95 different forms. If <code>Allow from all</code> is specified, then
96 all hosts are allowed access, subject to the configuration of the
97 <code class="directive"><a href="#deny">Deny</a></code> and <code class="directive"><a href="#order">Order</a></code> directives as discussed
98 below. To allow only particular hosts or groups of hosts to access
99 the server, the <var>host</var> can be specified in any of the
100 following formats:</p>
103 <dt>A (partial) domain-name</dt>
106 <div class="example"><h3>Example:</h3><p><code>
107 Allow from apache.org<br />
108 Allow from .net example.edu
110 <p>Hosts whose names match, or end in, this string are allowed
111 access. Only complete components are matched, so the above
112 example will match <code>foo.apache.org</code> but it will not
113 match <code>fooapache.org</code>. This configuration will cause
114 Apache to perform a double reverse DNS lookup on the client IP
115 address, regardless of the setting of the <code class="directive"><a href="../mod/core.html#hostnamelookups">HostnameLookups</a></code> directive. It will do
116 a reverse DNS lookup on the IP address to find the associated
117 hostname, and then do a forward lookup on the hostname to assure
118 that it matches the original IP address. Only if the forward
119 and reverse DNS are consistent and the hostname matches will
120 access be allowed.</p></dd>
122 <dt>A full IP address</dt>
125 <div class="example"><h3>Example:</h3><p><code>
126 Allow from 10.1.2.3<br />
127 Allow from 192.168.1.104 192.168.1.205
129 <p>An IP address of a host allowed access</p></dd>
131 <dt>A partial IP address</dt>
134 <div class="example"><h3>Example:</h3><p><code>
135 Allow from 10.1<br />
136 Allow from 10 172.20 192.168.2
138 <p>The first 1 to 3 bytes of an IP address, for subnet
139 restriction.</p></dd>
141 <dt>A network/netmask pair</dt>
144 <div class="example"><h3>Example:</h3><p><code>
145 Allow from 10.1.0.0/255.255.0.0
147 <p>A network a.b.c.d, and a netmask w.x.y.z. For more
148 fine-grained subnet restriction.</p></dd>
150 <dt>A network/nnn CIDR specification</dt>
153 <div class="example"><h3>Example:</h3><p><code>
154 Allow from 10.1.0.0/16
156 <p>Similar to the previous case, except the netmask consists of
157 nnn high-order 1 bits.</p></dd>
160 <p>Note that the last three examples above match exactly the
161 same set of hosts.</p>
163 <p>IPv6 addresses and IPv6 subnets can be specified as shown
166 <div class="example"><p><code>
167 Allow from 2001:db8::a00:20ff:fea7:ccea<br />
168 Allow from 2001:db8::a00:20ff:fea7:ccea/10
171 <p>The third format of the arguments to the
172 <code class="directive">Allow</code> directive allows access to the server
173 to be controlled based on the existence of an <a href="../env.html">environment variable</a>. When <code>Allow from
174 env=<var>env-variable</var></code> is specified, then the request is
175 allowed access if the environment variable <var>env-variable</var>
176 exists. The server provides the ability to set environment
177 variables in a flexible way based on characteristics of the client
178 request using the directives provided by
179 <code class="module"><a href="../mod/mod_setenvif.html">mod_setenvif</a></code>. Therefore, this directive can be
180 used to allow access based on such factors as the clients
181 <code>User-Agent</code> (browser type), <code>Referer</code>, or
182 other HTTP request header fields.</p>
184 <div class="example"><h3>Example:</h3><p><code>
185 SetEnvIf User-Agent ^KnockKnock/2\.0 let_me_in<br />
186 <Directory /docroot><br />
187 <span class="indent">
188 Order Deny,Allow<br />
190 Allow from env=let_me_in<br />
195 <p>In this case, browsers with a user-agent string beginning
196 with <code>KnockKnock/2.0</code> will be allowed access, and all
197 others will be denied.</p>
200 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
201 <div class="directive-section"><h2><a name="Deny" id="Deny">Deny</a> <a name="deny" id="deny">Directive</a></h2>
202 <table class="directive">
203 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Controls which hosts are denied access to the
205 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code> Deny from all|<var>host</var>|env=<var>env-variable</var>
206 [<var>host</var>|env=<var>env-variable</var>] ...</code></td></tr>
207 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
208 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Limit</td></tr>
209 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
210 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_access</td></tr>
212 <p>This directive allows access to the server to be restricted
213 based on hostname, IP address, or environment variables. The
214 arguments for the <code class="directive">Deny</code> directive are
215 identical to the arguments for the <code class="directive"><a href="#allow">Allow</a></code> directive.</p>
218 <div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
219 <div class="directive-section"><h2><a name="Order" id="Order">Order</a> <a name="order" id="order">Directive</a></h2>
220 <table class="directive">
221 <tr><th><a href="directive-dict.html#Description">Description:</a></th><td>Controls the default access state and the order in which
222 <code class="directive">Allow</code> and <code class="directive">Deny</code> are
224 <tr><th><a href="directive-dict.html#Syntax">Syntax:</a></th><td><code> Order <var>ordering</var></code></td></tr>
225 <tr><th><a href="directive-dict.html#Default">Default:</a></th><td><code>Order Deny,Allow</code></td></tr>
226 <tr><th><a href="directive-dict.html#Context">Context:</a></th><td>directory, .htaccess</td></tr>
227 <tr><th><a href="directive-dict.html#Override">Override:</a></th><td>Limit</td></tr>
228 <tr><th><a href="directive-dict.html#Status">Status:</a></th><td>Base</td></tr>
229 <tr><th><a href="directive-dict.html#Module">Module:</a></th><td>mod_access</td></tr>
232 <p>The <code class="directive">Order</code> directive, along with the
233 <code class="directive"><a href="#allow">Allow</a></code> and <code class="directive"><a href="#deny">Deny</a></code> directives, controls a
234 three-pass access control system. The first pass processes either
235 all <code class="directive"><a href="#allow">Allow</a></code> or all
236 <code class="directive"><a href="#deny">Deny</a></code> directives, as
237 specified by the <code class="directive">Order</code> directive. The second
238 pass parses the rest of the directives (<code class="directive"><a href="#deny">Deny</a></code> or <code class="directive"><a href="#allow">Allow</a></code>). The third pass applies to
239 all requests which do not match either of the first two.</p>
241 <p>Note that all <code class="directive"><a href="#allow">Allow</a></code>
242 and <code class="directive"><a href="#deny">Deny</a></code> directives are
243 processed, unlike a typical firewall, where only the first match is
244 used. The last match is effective (also unlike a typical firewall).
245 Additionally, the order in which lines appear in the configuration
246 files is not significant -- all <code class="directive"><a href="#allow">Allow</a></code> lines are processed as one
247 group, all <code class="directive"><a href="#deny">Deny</a></code> lines are
248 considered as another, and the default state is considered by
251 <p><em>Ordering</em> is one of:</p>
254 <dt><code>Allow,Deny</code></dt>
256 <dd>First, all <code class="directive"><a href="#allow">Allow</a></code>
257 directives are evaluated; at least one must match, or the request
258 is rejected. Next, all <code class="directive"><a href="#deny">Deny</a></code> directives are evaluated. If
259 any matches, the request is rejected. Last, any requests which do
260 not match an <code class="directive"><a href="#allow">Allow</a></code> or a
261 <code class="directive"><a href="#deny">Deny</a></code> directive are
262 denied by default.</dd>
264 <dt><code>Deny,Allow</code></dt>
266 <dd>First, all <code class="directive"><a href="#deny">Deny</a></code>
267 directives are evaluated; if any match, the request is denied
268 <strong>unless</strong> it also matches an <code class="directive"><a href="#allow">Allow</a></code> directive. Any requests
269 which do not match any <code class="directive"><a href="#allow">Allow</a></code> or <code class="directive"><a href="#deny">Deny</a></code> directives are
272 <dt><code>Mutual-failure</code></dt>
274 <dd>This order has the same effect as <code>Order
275 Allow,Deny</code> and is deprecated in its favor.</dd>
278 <p>Keywords may only be separated by a comma; <em>no whitespace</em>
279 is allowed between them.</p>
281 <table class="bordered">
284 <th>Allow,Deny result</th>
285 <th>Deny,Allow result</th>
287 <th>Match Allow only</th>
288 <td>Request allowed</td>
289 <td>Request allowed</td>
291 <th>Match Deny only</th>
292 <td>Request denied</td>
293 <td>Request denied</td>
296 <td>Default to second directive: Denied</td>
297 <td>Default to second directive: Allowed</td>
299 <th>Match both Allow & Deny</th>
300 <td>Final match controls: Denied</td>
301 <td>Final match controls: Allowed</td>
305 <p>In the following example, all hosts in the apache.org domain
306 are allowed access; all other hosts are denied access.</p>
308 <div class="example"><p><code>
309 Order Deny,Allow<br />
311 Allow from apache.org
314 <p>In the next example, all hosts in the apache.org domain are
315 allowed access, except for the hosts which are in the foo.apache.org
316 subdomain, who are denied access. All hosts not in the apache.org
317 domain are denied access because the default state is to <code class="directive"><a href="#deny">Deny</a></code> access to the server.</p>
319 <div class="example"><p><code>
320 Order Allow,Deny<br />
321 Allow from apache.org<br />
322 Deny from foo.apache.org
325 <p>On the other hand, if the <code class="directive">Order</code> in the
326 last example is changed to <code>Deny,Allow</code>, all hosts will
327 be allowed access. This happens because, regardless of the actual
328 ordering of the directives in the configuration file, the
329 <code>Allow from apache.org</code> will be evaluated last and will
330 override the <code>Deny from foo.apache.org</code>. All hosts not in
331 the <code>apache.org</code> domain will also be allowed access
332 because the default state is <code class="directive"><a href="#allow">Allow</a></code>.</p>
334 <p>The presence of an <code class="directive">Order</code> directive can
335 affect access to a part of the server even in the absence of
336 accompanying <code class="directive"><a href="#allow">Allow</a></code> and
337 <code class="directive"><a href="#deny">Deny</a></code> directives because
338 of its effect on the default access state. For example,</p>
340 <div class="example"><p><code>
341 <Directory /www><br />
342 <span class="indent">
343 Order Allow,Deny<br />
348 <p>will <code class="directive"><a href="#deny">Deny</a></code> all access
349 to the <code>/www</code> directory because the default access state
350 is set to <code class="directive"><a href="#deny">Deny</a></code>.</p>
352 <p>The <code class="directive">Order</code> directive controls the order of
353 access directive processing only within each phase of the server's
354 configuration processing. This implies, for example, that an
355 <code class="directive"><a href="#allow">Allow</a></code> or <code class="directive"><a href="#deny">Deny</a></code> directive occurring in a
356 <code class="directive"><a href="../mod/core.html#location"><Location></a></code> section
357 will always be evaluated after an <code class="directive"><a href="#allow">Allow</a></code> or <code class="directive"><a href="#deny">Deny</a></code> directive occurring in a
358 <code class="directive"><a href="../mod/core.html#directory"><Directory></a></code>
359 section or <code>.htaccess</code> file, regardless of the setting of
360 the <code class="directive">Order</code> directive. For details on the
361 merging of configuration sections, see the documentation on <a href="../sections.html">How Directory, Location and Files sections
366 <div class="bottomlang">
367 <p><span>Available Languages: </span><a href="../en/mod/mod_access.html" title="English"> en </a> |
368 <a href="../ja/mod/mod_access.html" hreflang="ja" rel="alternate" title="Japanese"> ja </a></p>
369 </div><div id="footer">
370 <p class="apache">Copyright 2009 The Apache Software Foundation.<br />Licensed under the <a href="http://www.apache.org/licenses/LICENSE-2.0">Apache License, Version 2.0</a>.</p>
371 <p class="menu"><a href="../mod/">Modules</a> | <a href="../mod/directives.html">Directives</a> | <a href="../faq/">FAQ</a> | <a href="../glossary.html">Glossary</a> | <a href="../sitemap.html">Sitemap</a></p></div>