Apache's Confusing Access Control

It happens so many times, you write Access Control in Apache by giving "Oder Allow,Deny" or "Order Deny,Allow".

But how would that be executed? I used to check it after applying ACL rules. But now below table will be helpful to evaluate rules.

Example:

	<Location /server-status>
	SetHandler server-status
	Order Allow,Deny
	Deny from 192.168.10.100
	Allow from 192.168.10.0/24
	</Location>

view raw Server Status hosted with ❤ by GitHub

Looking at above example, we can see that 192.168.10.100 will be denied as per below table.

	Match | Allow,Deny result | Deny,Allow result
	-------------------------------------------------------
	Allow only | Allowed | Allowed
	Deny only | Denied | Denied
	No match | Default: Denied | Default: Allowed
	Match both | Final match: Denied | Final match: Allowed

view raw Access Table hosted with ❤ by GitHub