title: How to block URL pattern using Apache with mod_wsgi
body: <p>I have a web2py application run under Apache via mod_wsgi.  <strong>How do I restrict access to the admin page (www.myapp.com/admin) based on source IP?</strong></p>
  
  <p>Ideally, I do it directly within Apache for two reasons: 1) I assume that Apache has more effective access to the source IP [citation needed] and 2) I don't feel like modifying the stock admin page in web2py to block specific IPs.</p>
  
  <p>My (abridged) configuration looks something like this:</p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
    WSGIDaemonProcess web2py user=myapp group=myapp
    WSGIProcessGroup web2py
    WSGIScriptAlias / /home/myapp/myapp/wsgihandler.py
  
    TimeOut 45
  
    ServerName myapp.com
    ServerAlias www.myapp.com
  
  
    &lt;Directory /home/myapp/myapp&gt;
  
      AllowOverride None
      Order Allow,Deny
      Deny from all
  
      &lt;Files wsgihandler.py&gt;
        Allow from all
      &lt;/Files&gt;
  
    &lt;/Directory&gt;
  
    #======================================
    # THIS IS WHAT I TRIED THAT DIDN'T WORK
    &lt;Directory /home/myapp/myapp/admin&gt;
      Order Deny,Allow
      Deny from all
      Allow from 127.0.0.1
    &lt;/Directory&gt;
    #======================================
  
    AliasMatch ^/static/(.*) \
             /home/myapp/myapp/applications/myapp/static/$1
    &lt;Directory /home/myapp/myapp/applications/myapp/static/&gt;
      Options -Indexes 
      Order Allow,Deny
      Allow from all
    &lt;/Directory&gt;
  
    # HTTPS enforcement
    # Out of convenience, forward /a* to https, covers /admin /appadmin and /a (front facing admin)
    RedirectMatch ^/a(.*) https://myapp.com/a$1
    RedirectMatch ^/c/(.*) https://myapp.com/c/$1
    RedirectMatch ^/w/user/login(?:/(.*)|$) https://myapp.com/w/user/login/$1
    RedirectMatch ^/w/user/register(?:/(.*)|$) https://myapp.com/w/user/register/$1
  
    CustomLog /var/log/apache2/access.log common
    ErrorLog /var/log/apache2/error.log
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>Note that I have a similar VirtualHost for port 443.  I just didn't include it for the sake of redundancy.</p>
  
  <p>Normally, it is my understanding that I could use something like the directory notation to deny access to certain directories.  However, the above didn't work and I wonder if it has to do with the WSGIScriptAlias directive.</p>