Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to restrict a staging server with basic auth, except for one special location, which should not have basic auth but be restricted to a client IP block.

My virtual host section looks like this:

DocumentRoot /var/www/vhosts/example/public

<Directory /var/www/vhosts/example/public>
    Options FollowSymLinks -MultiViews
    AllowOverride all
    Order allow,deny
    Allow from all

<Location />
    AuthUserFile /var/www/.htpasswd
    AuthType Basic
    AuthName "Secret"
    Require valid-user

<Location /payment/ipn>
    # How can I disable basic auth here?

    Order deny,allow
    Deny from all
    Allow from 216.113.191

So, nobody should be able to access the site, unless they know the password. But the PayPal Sandbox ( should be able to access to send instant payment notifications.

I'm hosting Rails 3 via Passenger on Apache2.

share|improve this question
up vote 2 down vote accepted

Sounds like you want Satisfy.

Satisfy Any
share|improve this answer

By default is set Satisfy All, then all authentication method should be true. Remember, subdirectory or sublocation inherits propertis from his master, and In your needs require should be any. If one requirement is done, other is not checked.

If you want more complicated behavior, you should use directives and . You can nest this directives creating complex cases. This all is described inside official apache docs, example is here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.