Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This is probably a simple problem, but I cant find the solution in the documentation.

I want to password protect my website using BASIC authentication. But I want a subdirectory to be non protected :

http://mysite.com/ -> BASIC protected
http://mysite.com/somedir -> BASIC protected
http://mysite.com/someotherdir -> BASIC protected
http://mysite.com/public -> not protected

I have no problem protecting all the site, but I dont know how I can "unprotect" one directory. The site is hosted on a shared host, so I only have access to .htaccess files to do the configuration.

Is there a directive to negate the authentication ?

Thanks for the help ...

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Shouldn't be a problem with .htaccess, depending on what the host has allowed.

You could try putting a .htaccess in the sub-folder with the following, although overrides will have to be enabled for the directories it's in.

 Allow From All
 Satisfy Any
share|improve this answer
1  
The secret sauce here, IIRC, is to put the .htaccess at the root of your site, but have an entry in that .htaccess file like the one Cylindric talks about. –  Paul Lathrop Jul 27 '09 at 16:39
    
And don't forget to add (or make sure there exists) an AllowOverride so the .htaccess will be used. –  TCampbell Jul 27 '09 at 17:13
1  
@Paul - I've deleted my answer, but AFAICR Cylindric's answer is currently wrong? A .htaccess file in a subdirectory cannot override one higher up. However the .htaccess file in the parent directory can also include controls (or indeed remove them) for subdirectories. –  Alnitak Jul 27 '09 at 17:27
    
I tried both putting a <Directory/> directive in the root folder and in the folder I want to be public, but in both cases I get an HTTP 500. Any other ideas ? –  Guillaume Jul 27 '09 at 20:47
1  
You can't use <Directory> in .htaccess, although you can use <Files> and <Location> –  Alnitak Jul 27 '09 at 21:50

OK, for a path server.com/private/public:

server.com/private/.htaccess

AuthType Basic
AuthName "Private, keep out."
Require...

server.com/private/public/.htaccess

Allow From All
Satisfy Any

The key here is 'Satisfy Any' which ORs the requirements from upstream together. 'Satisfy All' is the default.

share|improve this answer

I believe this might do it:

# put the global auth stuff here
...

# put the override here
<Location /public>
Allow from All
Satisfy Any
</Location>
share|improve this answer
    
It's never a good idea to use <Location>s for access control. It only controls access via a name, rather than the resource itself. Thus, anything that provides access to it via a different name (Alias, for example) has no access control applied to it. –  CK. Jul 29 '09 at 13:09
    
@CK Actually you must use Location if the location in question is not a physical directory but merely an "virtual" directory in disguise by something like mod_rewrite. –  Nathan Adams Nov 6 '10 at 17:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.