Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to turn off basic auth in Windows/IIS 7 that is enforced by the Helicon APE handler. It should be turned off for local IP#s e.g.

Cross-referencing the Apache docs with the Helicon docs this seems viable however the environment variable in the Apache example 'MODSEC_ENABLE=Off' doesn't seem to be supported on Windows.

Is there a Helicon alternative that works?

# Apache htaccess sample:
SetEnvIfNoCase Remote_Addr ^192\.168\..+$ MODSEC_ENABLE=Off
share|improve this question
I've also submitted a ticket to Helicon support. Either way, when I get it working, I'll ensure the answer is posted below for future reference, unless somebody else answers first from experience. – John K Oct 25 '11 at 15:39
up vote 0 down vote accepted

Your Ticket Has Been Updated


You recently logged a ticket with a subject of APE handler - Disabling security per IP# with us. This e-mail is to advise you of an update to that ticket.

The following comment was added to ticket [inbox-12956]:


Please try to add the following portion of code into the .htaccess with the auth directives:

# allow access by hosts rules or after authentication
# the following 4 lines should be added on top of your existing auth directives

Satisfy Any
Order Deny,Allow
Deny from all
Allow from localhost ::1

#this part should already exist in your file.
AuthType basic
AuthName "private area"
AuthBasicProvider file
AuthUserFile ../.htpasswd
Require valid-user


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.