I'd like to use Basic Auth only when HTTPS is used. Having a .htaccess like this the user must enter password twice
RewriteEngine On
RewriteOptions Inherit
# Rewrite to HTTPS (except for let's encrypt)
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/.*$
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
<RequireAny>
AuthType Basic
AuthName "Top Secret"
AuthUserFile /is/htdocs/***/.htpasswd
Require valid-user
</RequireAny>
Using this file:
- http://mysite.domain is called
- Authentication for 'http://mysite.domain' is requested (NoSSL)
- Redirect to https://mysite.domain is done
- Authentication for 'https://mysite.domain' is requested (SSL)
How can I avoid the authentication for 'http://mysite.domain' here?