Centos – .htaccess enabled, but not working

Unbelievable. Remember how I said this is a development server? Yeah.. well here's what my virtual host entry REALLY looks like:

<VirtualHost *>
    ServerName              dev.ourwebsite.com
    DocumentRoot            /var/www/html/dev.ourwebsite.com/docroot
    <Directory "/var/www/html/ourwebsite.com/docroot">
        Options FollowSymLinks
        AllowOverride All

        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

Do you see it? Well I didn't. I FORGOT To change my "Directory" entry to dev.ourwebsite.com instead of ourwebsite.com -- and that made all the difference. I just assumed that Apache would have thrown an error if the directory didn't exist; but that only applies to the DocumentRoot directive. is match-based -- meaning it applies the rules if it matches the incoming request, but otherwise, it doesn't care if you tell it to AllowOverride on magic unicorns.

Let this be a lesson to any others who come looking -- when all else fails, consider the almighty Typo.

.htaccess files can interact with the main config in unobvious ways. In your case your problem is that you have access control bot in your httpd.conf and your .htaccess file. And they get both applied.

You have in your config:

Order allow,deny
allow from all

And in your .htaccess file:

Order Deny,Allow
Deny from all

So the end result is as if the permissions are:

Order Deny, Allow
Deny From All
Allow From ALL

Which means that everyone gets access. In this case you should use "Order Allow, Deny".

You should however not use .htaccess files at all if you have access to the main config. .htaccess files exist as a workaround for cases where you don't have the right to edit the main config (like shared hosting) but if you can edit the main config you should use that.

.htaccess files have a lot of disadvantages. They are only read at request time, and only after the server has translated the URL to a file system resource. They are not read when the server startes. This means that the .htaccess files are possibly read at every request (causing a performance hit), but sometimes not read ever.