htaccess to Password Protect Everything but the Non-File Index

Question

I have searched SO and ServerFault for an hour trying to find the answer, but was unable to. I am sure similar questions have been asked, but here is what I am trying to do:

I just want the site root to be public, and any other url to be password protected. I already have a passwd file ready and working. So,

http://example.com/ works but http://example.com/foo would require a password. I cannot do this file-based, because I am running a WSGI application, not an actual index.html. And please specify if the directives should go into a .htaccess or the server's httpd.conf.

Thanks!

Answer: Based on Shane's response, here is the config in my httpd.conf:

<Directory *>
AuthUserFile /path/to/.htpasswd
AuthGroupFile /dev/null
AuthName "Password Protected Area"
AuthType Basic
AllowOverride All
</Directory>

<LocationMatch "/.+">
Require valid-user
</LocationMatch>

Just in case anyone comes across the page and doesn't have that first information.

Answer 1

<LocationMatch "/.+">
    Require valid-user
</LocationMatch>

Anything with one or more characters after the slash will get hit with the Require statement; you'll need to remove your current Require but leave the rest of your password config in place.

It should go in the site config, be it httpd.conf or a VirtualHost file.