I have searched SO and ServerFault for an hour trying to find the answer, but was unable to. I am sure similar questions have been asked, but here is what I am trying to do:
I just want the site root to be public, and any other url to be password protected. I already have a passwd file ready and working. So,
http://example.com/ works but http://example.com/foo would require a password. I cannot do this file-based, because I am running a WSGI application, not an actual index.html. And please specify if the directives should go into a .htaccess or the server's httpd.conf.
Answer: Based on Shane's response, here is the config in my httpd.conf:
<Directory *> AuthUserFile /path/to/.htpasswd AuthGroupFile /dev/null AuthName "Password Protected Area" AuthType Basic AllowOverride All </Directory> <LocationMatch "/.+"> Require valid-user </LocationMatch>
Just in case anyone comes across the page and doesn't have that first information.