Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to protect an entire virtual host in Apache, but I still want to allow public access to a single file. The virtual host proxies all requests to a Tomcat server on the back end. What's the best way to do this?

I tried setting up my virtual host definition as follows, but it still requires a password for the file I want to be exposed publicly:

<VirtualHost *>

    <Location / >
      Order Allow,Deny
      Allow from all
      AuthType Basic
      AuthName "Restricted Access"
      AuthUserFile /etc/apache2/secrets.htpasswd
      Require valid-user

    <Location /foo/bar.html>
      Order Allow,Deny
      Allow from all


Any suggestions?

share|improve this question
up vote 2 down vote accepted

Both <Location> sections apply to your file, and so they are both processed for it in order. Your second section doesn't override anything from your first, so the AuthType and Require directives, etc, remain intact.

If you add the directive "Satisfy any" directive ( in the latter section, I believe that should allow all traffic thanks to your "Order Allow,Deny" and "Allow from all". You can leave out repeating those two directives, though.

share|improve this answer
Awesome! Thanks! – organicveggie Jul 1 '10 at 16:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.