Apache Forward Proxy Authorization: Require and AuthMerging
Trace global and virtual-host proxy authorization through Apache’s section-merging rules rather than treating proxy.conf as a separate policy layer.
A rule in proxy.conf is not a special class of rule. Apache reads included configuration into its configuration tree; the enclosing global, VirtualHost or matching section determines how the directive participates.
Start with the listener and virtual host serving the forward-proxy request. Then collect the matching Proxy sections from that context and the main configuration. The order of section processing matters, not merely which file was edited last.
Authorization is not always cumulative
With the default AuthMerging Off behavior, authorization is inherited until a later applicable section supplies its own authorization logic. That new logic can replace the preceding requirements rather than adding another restriction.
| Setting | Combination with the nearest preceding authorization section |
|---|---|
| Off | New authorization can override inherited logic |
| And | Both sets must authorize |
| Or | Either set may authorize |
AuthMerging itself is local to the section containing it. Do not assume setting And once changes every later section.
Keep the intended policy explicit where possible. Two Require lines without an enclosing authorization container are implicitly alternatives, so an IP rule plus valid-user is not automatically “IP and user.” Use RequireAll when both conditions belong to the same decision.
Review the complete matching configuration before changing a proxy account or opening access. Then test the permitted and denied cases against the running listener. A request can be rejected—or unexpectedly permitted—because another section supplied the effective authorization.