I want users to be authenticated when calling a specific HTTP method, while not needing to be authenticated when calling other HTTP methods. I use the Limit
directive, because that's supposed to do what I want, but I can't get it to work.
SSLVerifyClient none
<Location /foo>
SSLVerifyClient none
<Limit PUT>
SSLVerifyClient require
</Limit>
</Location>
It seems that the last SSLVerifyClient
statement is always executed, no matter which call I make (PUT, DELETE)
I also tried to use LimitExcept
but it has the same faulty behavior.
Since I cannot find answers online, I assume that this is a no-brainer, but I started working on this last week to fill in for a colleague that is on holiday. Can someone help me?