Is it possible to "DENY ALL" at the virtual host level and then allow specific IPs to access specific URLs within the virtual host at the context level?
I have tried this, but the IPs are not granted access. It seems that the virtual host level access control overrides the context level. I expected the reverse: that the per-context access control settings would override any set at the virtual host or server level (since it is more specific).
Since the access controls are applied at different stage, only IPs pass server level can reach vhost, if it passes vhost level then reach context level. That is how it works.
You can use a vhost level rewrite rule to implement what you want.
Per-Context Access Control
Linear Mode
