Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two site hosted as subdomains.

One of the site use subdomains as aliases for dynamic images requests. -> same as site1 -> same as site1 -> same as site1

Dynamic images are requested by

In the htaccess I want to:

  • limit access to site1 and site2 (same user and password)
  • have no authentication prompt on subXs
  • redirect everything to images.php for subXs requests

Limitations: I don't have access to httpd.conf so no directory block

I tested SetEnv, SetEnvIf, IfDefine with no success.

share|improve this question
Are you saying that requests for: should be rewritten as – Marco Bizzarri Aug 8 '11 at 16:02
No, for example should be rewrittent as A simple rewritte rule can do that (everything not images.php -> images.php) with a cond on the host. – GMO Aug 8 '11 at 18:53

To handle the first 2 items, you need to use the SetEnvIf along with a Satisfy, something like this:

SetEnvIf Host need_auth
SetEnvIf Host need_auth

Order allow,deny

# setup whatever auth stuff you need here
AuthName "Private"
AuthType Basic
AuthBasicProvider file
AuthUserFile /etc/apache2/pwd

# here's where you actually check the credentials and env
Require valid-user
Allow from env=!need_auth
Satisfy Any

To do the redirect, you can use mod_rewrite. I'm not exactly sure what you mean, but if you want everything redirected to images.php, you can do something like:

RewriteCond %{ENV:need_auth} ^.*$
RewriteRule ^(.*)$ [R]

It would probably be a lot easier if you added a RedirectMatch in the vhost file for the domains. The .htaccess file is designed to be per-directory based configuration, and not host-based. It's not really designed to do the things you're asking.

share|improve this answer
I don't have access to the vhost too :( – GMO Aug 8 '11 at 18:56
I will test your solution, seems ok on paper ;) – GMO Aug 8 '11 at 18:57
Not ok. The satisfy any cancel the authentication prompt all the time. It seems the Allow from env=!need_auth does not work too. I tweaked it in every way i can think of, without luck. – GMO Aug 9 '11 at 7:54

I found a solution. It merit an A+ in weirdness.

In the root .htaccess :

AuthUserFile /var/www/.htpasswd # will be inherited by children directories .htaccess

An in site1 directory .htaccess :

SetEnvIf host ^s[0-9]+\. sub # Detect if the host target a subdomain for images

AuthName "Restricted Area"
AuthType Basic

Order Deny,Allow
Require valid-user

# Access to anything except image.php is forbidden on subdomains for images
<FilesMatch .*>
    Deny from env=sub

# Access to image.php does not required authentication in subdomains for images
<Files image.php>
    Allow from env=sub
    Satisfy any

And in site2 directory .htaccess :

AuthName "Restricted Area"
AuthType Basic

Order Deny,Allow
Require valid-user
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.