5

With Apache2 how may I require a valid user for every page except these special pages which can be seen by anybody?

Thanks in advance for your thoughts.


Update in response to comments; here is a working apache2 config:

<Directory /var/www/>
    Options Indexes FollowSymLinks MultiViews
    Order allow,deny
    allow from all
</Directory>

# require authentication for everything not specificly excepted
<Location / >
    AuthType Basic
    AuthName "whatever"
    AuthUserFile /etc/apache2/htpasswd
    Require valid-user
    AllowOverride all                       
</Location>

# allow standard apache icons to be used without auth (e.g. MultiViews)
<Location /icons>
    allow from all
    Satisfy Any
</Location>

# anyone can see pages in this tree
<Location /special_public_pages>
    allow from all
    Satisfy Any
</Location>
2
  • did you actually checked what's happening on the wire or at least in logs? isn't that your browser asking ag for /favicon.ico what triggers credentials request?
    – pQd
    Jan 6, 2010 at 9:32
  • ahhh, that pointed me in the right direction. Favicon doesn't appear to need authentication or exception, but /icons/* for MultiViews does. Thanks! Jan 6, 2010 at 23:48

1 Answer 1

4

this should do a trick:

<Location / >
 AuthType Basic
 AuthName "whatever"
 AuthUserFile /etc/apache2/htpasswd
 Require valid-user
 AllowOverride all                       
</Location>

<Location /yourspecial>
 allow from all
 Satisfy Any
</Location>

satisfy any is the cruicial one..

6
  • except satisfy is not valid for <Location> :( <httpd.apache.org/docs/2.0/mod/core.html#satisfy> Dec 29, 2009 at 2:38
  • @matt wilkie - believe me or not - this is tested working config.
    – pQd
    Dec 29, 2009 at 6:37
  • @pQd hmm, it appears in this instance the documentation is wrong. Thanks for the help Jan 5, 2010 at 22:16
  • sorry, I have to retract the accepted answer status. I thought it was working but when I went to a different machine the "popup auth dialog first then show the special page" behaviour reasserted itself. Jan 5, 2010 at 22:51
  • did you checked what happens at http level [ with fiddler of wireshark ]? are you sure it's not a problem of missing / at the end of url?
    – pQd
    Jan 5, 2010 at 23:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .