Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

With Apache2 how may I require a valid user for every page except these special pages which can be seen by anybody?

Thanks in advance for your thoughts.


Update in response to comments; here is a working apache2 config:

<Directory /var/www/>
    Options Indexes FollowSymLinks MultiViews
    Order allow,deny
    allow from all
</Directory>

# require authentication for everything not specificly excepted
<Location / >
    AuthType Basic
    AuthName "whatever"
    AuthUserFile /etc/apache2/htpasswd
    Require valid-user
    AllowOverride all                       
</Location>

# allow standard apache icons to be used without auth (e.g. MultiViews)
<Location /icons>
    allow from all
    Satisfy Any
</Location>

# anyone can see pages in this tree
<Location /special_public_pages>
    allow from all
    Satisfy Any
</Location>
share|improve this question
    
did you actually checked what's happening on the wire or at least in logs? isn't that your browser asking ag for /favicon.ico what triggers credentials request? –  pQd Jan 6 '10 at 9:32
    
ahhh, that pointed me in the right direction. Favicon doesn't appear to need authentication or exception, but /icons/* for MultiViews does. Thanks! –  matt wilkie Jan 6 '10 at 23:48

1 Answer 1

up vote 1 down vote accepted

this should do a trick:

<Location / >
 AuthType Basic
 AuthName "whatever"
 AuthUserFile /etc/apache2/htpasswd
 Require valid-user
 AllowOverride all                       
</Location>

<Location /yourspecial>
 allow from all
 Satisfy Any
</Location>

satisfy any is the cruicial one..

share|improve this answer
    
except satisfy is not valid for <Location> :( <httpd.apache.org/docs/2.0/mod/core.html#satisfy>; –  matt wilkie Dec 29 '09 at 2:38
    
@matt wilkie - believe me or not - this is tested working config. –  pQd Dec 29 '09 at 6:37
    
@pQd hmm, it appears in this instance the documentation is wrong. Thanks for the help –  matt wilkie Jan 5 '10 at 22:16
    
sorry, I have to retract the accepted answer status. I thought it was working but when I went to a different machine the "popup auth dialog first then show the special page" behaviour reasserted itself. –  matt wilkie Jan 5 '10 at 22:51
    
did you checked what happens at http level [ with fiddler of wireshark ]? are you sure it's not a problem of missing / at the end of url? –  pQd Jan 5 '10 at 23:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.