Apache .htaccess set base for absolute path

Took me a while to find out as well, but the reason is mentioned in the mod_rewrite documentation:

REQUEST_FILENAME The full local filesystem path to the file or script matching the request, if this has already been determined by the server at the time REQUEST_FILENAME is referenced. Otherwise, such as when used in virtual host context, the same value as REQUEST_URI.

That's why it works in .htaccess but not in the conf file of the vhost. (And that's also why adding the DOCUMENT_ROOT works around the problem).

.htaccess files can interact with the main config in unobvious ways. In your case your problem is that you have access control bot in your httpd.conf and your .htaccess file. And they get both applied.

You have in your config:

Order allow,deny
allow from all

And in your .htaccess file:

Order Deny,Allow
Deny from all

So the end result is as if the permissions are:

Order Deny, Allow
Deny From All
Allow From ALL

Which means that everyone gets access. In this case you should use "Order Allow, Deny".

You should however not use .htaccess files at all if you have access to the main config. .htaccess files exist as a workaround for cases where you don't have the right to edit the main config (like shared hosting) but if you can edit the main config you should use that.

.htaccess files have a lot of disadvantages. They are only read at request time, and only after the server has translated the URL to a file system resource. They are not read when the server startes. This means that the .htaccess files are possibly read at every request (causing a performance hit), but sometimes not read ever.