title: Multiple Apache Location directives for same path
body: <p>I have a web application currently being served on two HTTPS ports - let's say <em>443</em> and <em>8443</em>. The application has an Apache HTTP server as the front end and I am running into trouble <em>setting up Apache config to exclude certain paths on one of the ports</em>. I have my config set up as below in <em>Apache</em></p>
  
  <pre><code>&lt;Location /MyApp&gt;
    AuthType SOME_AUTH_MODULE
    require user valid-user
  &lt;/Location&gt;
  
  &lt;Location ~ "/MyApp/(Login.html|Welcome.html)"&gt;
    Satisfy Any
    Allow from all
    AuthType None
    Require all granted
  &lt;/Location&gt;
  </code></pre>
  
  <p>I have my virtual hosts setup in Apache as below</p>
  
  <pre><code>&lt;VirtualHost _default_:443&gt;
    DocumentRoot /path/to/my/files
    Servername www.example.com:443
    Other details go here
  
  &lt;/VirtualHost&gt;
  
  &lt;VirtualHost _default_:8443&gt;
    DocumentRoot /path/to/my/files
    Servername www.example.com:8443
    Other details go here
  
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>What are the expected problems with above configuration, considering that <em>Location</em> directive doesn't take <em>host</em> and <em>port</em> information? <em>Does Location directive use the first matching entry OR will it use one of after the other</em>?</p>
  
  <p><strong>More details for folks who know Shibboleth</strong></p>
  
  <p>The first Location entry allows users to access the application in an SSO (Single Sign On) environment. The second entry is designed to allow users to access the same virtual host on a different port (8443) without going through SSO. What we are seeing is, the request headers are lost towards the end of the processing chain. When I remove the second Location entry all works fine.</p>