Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I can't figure out how to write an .htaccess file which blocks all access to a directory except for reading html files, which sould be allowed and php-files which require athentication. Denying all access and allowing html works fine but asking for a password for php-files doesn't.

Here is what I came up with:

<FilesMatch  ".*\.php$">
        AuthName "Test area"
        AuthUserFile /var/www/.htpasswd
        AuthType Basic
        require valid-user
</FilesMatch>

<FilesMatch "\.html?$">
        Order Allow,Deny
        Allow from All
</FilesMatch>

order Allow,Deny
Deny from ALL

Thanks,

AC

share|improve this question

1 Answer 1

up vote 2 down vote accepted

I guess to pass authentification or authorization instead of both, you need a Satisfy Any (default is Satisfy All)

Order deny,allow
Deny from all

<FilesMatch  "\.php$">
    Satisfy Any
    AuthName "Test area"
    AuthUserFile /var/www/.htpasswd
    AuthType Basic
    require valid-user
</FilesMatch>

<FilesMatch "\.html?$">
    Allow from All
</FilesMatch>

Note: for Apache >= 2.4, this method is deprecated (cf new <Require(All|None|Any)> and Require directives).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.