Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'd like to allow directory browsing for users logged in via HTTP Basic authentication but prevent it for anonymous users. Is there a way to do this using .htaccess?

share|improve this question

2 Answers 2

up vote 1 down vote accepted
RewriteEngine on
RewriteCond %{REMOTE_USER} =""
RewriteCond %{REQUEST_FILENAME} -d
RewriteCond %{REQUEST_FILENAME}/index.html !-f
RewriteCond %{REQUEST_FILENAME}/index.php !-f
RewriteRule .? - [F,L]

You'll need to chain together as many index.foo types as you use.

This is assuming that by 'logged in user' you mean someone logged in using HTTP BASIC authentication. If you mean someone logged in to a custom authentication mechanism, you'd need to hook a rewrite map into that, which probably isn't worth the effort; at that point I'd put an index.foo in all of my directories that checked for my custom authentication and sent an index or not, depending.

share|improve this answer


Explains exactly how to do that. The Require parameter will be what you want to look at.

share|improve this answer
I misread the question the same way, first. He's not asking how to control overall access to his site; he's asking about allowing or denying directory indexes. –  chaos Jun 3 '09 at 21:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.