#providers
Posts
-
Digging into Apache httpd's Source 13: Authentication and Authorization — How a Require Line Is Decided
We follow what AuthType Basic, AuthUserFile, Require valid-user and <RequireAll> in httpd.conf actually do in the source. Why "who are you" (authentication) and "may you come in" (authorization) live in separate modules, providers that are swapped in by name, the Require tree and its GRANTED, DENIED and NEUTRAL results, and the order in request.c that runs the same decision twice — all checked against the real source and example output.