How to correctly restrict access to some folders via htaccess?

Question

I have such directiry structure:

- www
    - folder1
        - folder2
            - folder21
            - folder22
            - folder23

I allowed all image files to be accessed

<FilesMatch \.(?i:gif|jpe?g|png)$>
    Order Deny,Allow
    Allow from all 
</FilesMatch>

I allowed all all files in certain folder to be accessed

<FilesMatch /folder2/folder22/.*>
    Order Deny,Allow
    Allow from all 
</FilesMatch>

I allowed all robots.txt files to be accessed

<FilesMatch (robots\.txt)$>
    Order Deny,Allow
    Allow from all 
</FilesMatch>

And at the end I added password restriction

AuthType Basic
AuthName "Personal use"
AuthUserFile /full/path/to/.htpasswd
Require valid-user

But when I try to access any image file via browser, I get password prompt. Could anyone explain how to fix it and what might be the problem. Thank you.

Answer 1

Order Deny,Allow means that the deny rules are processed before the allow rules. Therefore, you will get a password prompt.

For any folders and filetypes that you want to allow access, just put the below config into your .htaccess:

<FilesMatch "\.(gif|jpe?g|png)$">
    Order Allow,Deny
    Allow from all 
    Satisfy Any
</FilesMatch>

Answer 2

You just need to add a satisfy Any directive to each of the FilesMatch blocks.

<FilesMatch \.(?i:gif|jpe?g|png)$>
    Order Deny,Allow
    Allow from all
    Satisfy Any    
</FilesMatch>