I have an Apache (2.2) serving a web-app on example.com
. That web-app has a debug-page reachable via example.com/debug
. /debug
is currently protected with a HTTP basic auth. As there is only a very small user-base who has access to the debug-page, I would like to hide it based on IP address and return 404
to clients not accessing from our VPN.
Serving a 404 based on IP-address only is easy and is described in https://serverfault.com/a/13071.
But as soon I add authentication, the users see a 401
instead of a 404
.
Basically, what I need is:
if ($REMOTE_ADDR ~ 10.11.12.*):
do_basic_auth (aka return 401)
else:
return 404
UPDATE This works:
<VirtualHost ...>
...
SetEnvIf REMOTE_ADDR 10.128.0.* HAS_debug=1
SetEnvIf REMOTE_ADDR 10.128.1.* HAS_debug=1
SetEnvIf REMOTE_ADDR 10.128.2.* HAS_debug=1
RewriteEngine On
RewriteCond %{ENV:HAS_debug} !=1
RewriteRule ^/debug($|/) - [R=404,L]
<Location /debug>
AuthType Basic
AuthName "hidden-debug"
AuthUserFile ...
Require valid-user
</Location>
</VirtualHost>
The crucial part was rewriting outside of the Location
.