I'm trying to expose a location through Apache. Normally, I have this block in my vhost that says
<Location /> AuthType Basic AuthUserFile /web/.htpasswd AuthName "Test Site" Require valid-user </Location>
This works just fine - everything served up requires a valid user. Now I want to expose a service that doesn't require authentication so I'm looking for a way to make all locations except for /services require authentication. I've been playing with LocationMatch, but I'm not entirely clear on what it's doing.
<LocationMatch ^/(?!services)[^.]*$> AuthType Basic ... </LocationMatch>
Allows /services and everything beneath it to skip the LocationMatch, but it has the side-effect of allowing example.com/.somefile to bypass the LocationMatch block.
Additionally, when I tried
<LocationMatch ^/(?!services)> AuthType Basic ... </LocationMatch>
everything (including /services) is matched by the LocationMatch.
I'd appreciate if someone could tell me what the [^.]* class does that the second test doesn't and how to expose only /services while keeping all other paths under authentication.