I have a public website with some URLs/directories which are for private/internal use only. These private areas can only be accessed via certain IP addresses or with a known username/password.
Currently I achieve this via .htaccess files like this:
AuthType Basic AuthName "Protected Area" AuthUserFile /path/to/.htpasswd SetEnvIf Remote_Addr 126.96.36.199 trusted SetEnvIf X-Forwarded-For 188.8.131.52 trusted # (Note I am aware X-Forwarded-For can be spoofed) <RequireAny> Require env trusted Require valid-user </RequireAny>
The problem is I want to add Varnish in front of my server to provide caching. Obviously the existing setup won't work with Varnish because it can't cache content restricted by .htaccess files in this way.
Is there a way I can continue to use my .htaccess files to protect my internal pages, or is there a similar approach I can use to place the responsibility for security on Varnish itself which doesn't require changing Varnish's VCL files every time I want to add or modify the restrictions?