0

I'd like to use Basic Auth only when HTTPS is used. Having a .htaccess like this the user must enter password twice

RewriteEngine On
RewriteOptions Inherit

# Rewrite to HTTPS (except for let's encrypt)
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/.*$
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

<RequireAny>
    AuthType Basic
    AuthName "Top Secret"
    AuthUserFile /is/htdocs/***/.htpasswd
    Require valid-user
</RequireAny>

Using this file:

How can I avoid the authentication for 'http://mysite.domain' here?

1 Answer 1

0

Found it, using REQUEST_SCHEME.

<If "%{REQUEST_SCHEME} == 'https'">
    <RequireAny>
        AuthType Basic
        AuthName "Top Secret"
        AuthUserFile /is/htdocs/***/.htpasswd
        Require valid-user
    </RequireAny>
</If>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .