title: OpenBSD's httpd daemon {block} directives not working
body: <p>I'am trying to restrict access to some subfolders of simple website hosted on OpenBSD's httpd native server. Config is rather simple, it is for testing purposes:</p>
  <pre><code>server &quot;10.0.1.222&quot; {
          listen on 10.0.1.222 port 80
          log style combined
          location &quot;/*php*&quot;{
                  root &quot;/FOLDER&quot;
                  fastcgi socket &quot;/run/php-fpm.sock&quot;
          }
  
          directory {
                  index &quot;index.php&quot;
          }
  
          location &quot;/*&quot; {
                  root &quot;/FOLDER&quot;
          }
  
          location &quot;/SUBFOLDER/*&quot; {block}
  }
  </code></pre>
  <p>Inside the <code>SUBFOLDER</code> I placed some htmls not intended to direct viewing.
  With last <code>location</code> directive I expect requests like <code>http://10.0.1.222/SUBFOLDER/01.html</code> to be blocked with <code>403</code> code but I can't achieve it.</p>
  <p>While <code>http://10.0.1.222/SUBFOLDER/</code> returns <code>access denied</code>, requesting any proper html document name within <code>SUBFOLDER</code> serves that request without any complaints.</p>
  <p>If string: <code>/SUBFOLDER/*</code> is (as I suppose) proper shell glob that should match string <code>/SUBFOLDER/</code> itself + any string given after, then requests like <code>http://10.0.1.222/SUBFOLDER/01.html</code> should be returned with code <code>403</code>. But it isn't working.
  I tried many combinations: <code>&quot;/SUBFOLDER/*&quot;</code>, <code>&quot;/SUBFOLDER/*.html&quot;</code> and so on with or without leading <code>/</code>. No effect.</p>
  <p>There is probably something I do not understand, but I can't debug my mistake.
  What am I missing?</p>