Apache 2.4 .htaccess Require statements ignored

Question

I'm trying to restrict per-client subdirectories of an application containing static reports using .htaccess files programatically generated with a list of users for each customer, but while I can demonstrate that the .htaccess file is being parsed (500 ISE if it contains garbage, AllowOverride is working) none of the more restrictive Require statements are overriding the Require valid-user in the higher-level Location directive.

eg. /etc/httpd/conf.d/app.conf

<VirtualHost *:80>
ServerName app

RewriteEngine on
RewriteRule ^/cgi-bin\/api\/(\w+)$ /var/www/cgi-bin/App.cgi?mode=json&request=$1 [QSA,H=cgi-script]

<Directory "/var/www/cgi-bin/">
  Options ExecCGI
</Directory>
<Directory "/var/www/cgi-bin/api/reports/">
  AllowOverride FileInfo AuthConfig
  Options +Indexes +FollowSymLinks -ExecCGI
  IndexOptions +NameWidth=*
  SetHandler default-handler
  LogLevel trace8
</Directory>


<Location /cgi-bin/>
  AuthType Basic
  AuthName "App Server"
  AuthUserFile /etc/httpd/conf.d/app.passwd
  require valid-user
</Location>
<Location /cgi-bin/api/>
  AuthType Basic
  AuthName "App API"
  AuthUserFile /etc/httpd/conf.d/app-api.passwd
  Require valid-user
  LogLevel trace8
</Location>
</VirtualHost>

/var/www/cgi-bin/api/reports/customer1/.htaccess

Require user CUSTOMER1

I have LogLevel trace8 on for the reports directory and I see

AH01626: authorization result of Require valid-user : denied (no authenticated user yet)
AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
AH01626: authorization result of Require valid-user : granted,
AH01626: authorization result of <RequireAny>: granted
Response sent with status 200

nothing I put in the .htaccess file seems to be referenced, wrapping Require statements in RequireAll doesn't do anything, setting Require all denied doesn't do anything, Apache is not treating the .htaccess directives as more specific than the Location directive in the config at a (higher, lefter) part of the URI.

edited: Tried adding FileInfo with no effect. Updated the example to be more complete. Settings Location /cgi-bin/api/reports/customer1 Require user CUSTOMER1 works just fine in the config, I was just trying to avoid requiring a webserver reload every time the jobs run and rebuild the .htaccess AuthZ files as some of the jobs run every minute and I didn't want to take the effort of building a more complete tool, that can reload httpd only when there are material AuthZ changes, since in theory .htaccess should be capable of making apache check for AuthZ changes on every access without privileged reloads.

Answer 1

Answer After Initial Question

<Directory> and <Location> directives are not allowed within .htaccess files (see Context section).

Just place a separate .htaccess file within the /foo/bar/reports/ folder containing the Auth* and Require directives. Make sure that the path to your .htpasswd file is valid (absolute paths should be preferred).

If it still does not work check that the AllowOverride directive was set correctly (i.e. within a <Directory> directive) within the virtual host / server config (.conf file within the /etc/apache2/ folder).

---

Answer After Question's 1st Edit

A .htaccess file is the equivalent of a <Directory> directive inside a .conf file. At the moment you are mixing <Directory> and <Location> directives for authentication. Would you please remove the <Location> directives from your .conf file and replace your <Directory> directions with the following, while letting the .htaccess files untouched:

<Directory "/var/www/cgi-bin/">
  Options ExecCGI
  AuthType Basic
  AuthName "App Server"
  AuthUserFile /etc/httpd/conf.d/app.passwd
  require valid-user
</Directory>
<Directory "/var/www/cgi-bin/api/">
  AuthType Basic
  AuthName "App API"
  AuthUserFile /etc/httpd/conf.d/app-api.passwd
  Require valid-user
  LogLevel trace8
</Directory>
<Directory "/var/www/cgi-bin/api/reports/">
  AllowOverride FileInfo AuthConfig
  Options +Indexes +FollowSymLinks -ExecCGI
  IndexOptions +NameWidth=*
  SetHandler default-handler
  LogLevel trace8
</Directory>

Until you edited your question, I assumed that the <Location> directives were placed inside a .htaccess file and would point to virtual folders instead of actual filesystem locations. However, the manual explicitly states:

It is important to never use <Location> when trying to restrict access to objects in the filesystem. This is because many different webspace locations (URLs) could map to the same filesystem location, allowing your restrictions to be circumvented.

Answer 2

Your AllowOverride directive is lacking.

In spite of what the documentation for the Require Directive says, the command should be:

AllowOverride FileInfo AuthConfig