Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to allow directory browsing for users logged in via HTTP Basic authentication but prevent it for anonymous users. Is there a way to do this using .htaccess?

share|improve this question
up vote 1 down vote accepted
RewriteEngine on
RewriteCond %{REMOTE_USER} =""
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{REQUEST_FILENAME}/index.html !-f
RewriteCond %{REQUEST_FILENAME}/index.php !-f
RewriteRule .? - [F,L]

You'll need to chain together as many types as you use.

This is assuming that by 'logged in user' you mean someone logged in using HTTP BASIC authentication. If you mean someone logged in to a custom authentication mechanism, you'd need to hook a rewrite map into that, which probably isn't worth the effort; at that point I'd put an in all of my directories that checked for my custom authentication and sent an index or not, depending.

share|improve this answer

Explains exactly how to do that. The Require parameter will be what you want to look at.

share|improve this answer
I misread the question the same way, first. He's not asking how to control overall access to his site; he's asking about allowing or denying directory indexes. – chaos Jun 3 '09 at 21:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.