When creating directives in httpd.conf, the ability is there to create an alias for a path.
i.e. Alias /data/ /var/www/data/
Access to this directory is not being restricted by mod_auth_vas when the directive is setup.
Directory-pathhat to beeither the full path to a directory, or a wild-card string.
Enter thefull path into thedirective for this to work properly.