3

I have basic auth set for Directory / and want to exclude Location /assets/upload, but it just won't work, I have tried several options and tutorials.

This Location directive clears the Directory auth config and disables basic auth for the whole website:

<Directory "/">
    AuthType Basic
    AuthName "Staging"
    AuthUserFile /var/.../.htpasswd
    AuthGroupFile /dev/null
    Require valid-user
</Directory>

<Location "/">
    Order deny,allow
    Allow from all
    Satisfy any
</Location>

However, I just want /assets/upload to be without basic auth, but if I change the 1st parameter of Location to /assets/upload, the whole page, including /assets/upload is protected by basic auth...

<Location "/assets/upload">
    Order deny,allow
    Allow from all
    Satisfy any
</Location>

What could be wrong here?

Version: Apache/2.2.16 (Debian)

7

I'm afraid you seem to have misunderstood a few Apache concepts here. The argument in a <Directory> block is a full file system path, not one relative to the server root. You should never really change the <Directory /> block from the default. You do not need to change it for your configuration to work.

The argument to a <Location> block is relative to the server root. So you just need two of these blocks to achieve what you wish.

<Location "/assets/upload">
    Order deny,allow
    Allow from all
    Satisfy any
</Location>

<Location "/">
    AuthType Basic
    AuthName "Staging"
    AuthUserFile /var/.../.htpasswd
    AuthGroupFile /dev/null
    Require valid-user
</Location>

You should have a single <Directory /> block in the global/server context (i.e. not inside any vhost) and it should be something like this.

<Directory />
    Options FollowSymLinks
    AllowOverride None
    Order allow,deny
    Deny from all
</Directory>
4

In the /assets/upload directory, put another .htaccess file with these contents;

Allow from all
Satisfy any

This will override the more general settings of the file in the directory above it, and serve assets without requiring authorization.

2
  • I can't put a .htaccess there as I am using the CakePHP framework - the initial request will always be to the index.php file. That's also the reason why I can't use the Directory but Location directive instead to disable auth basic for /assets/upload...
    – mplattner
    Feb 6 '13 at 0:39
  • same problem here. Dec 11 '16 at 22:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.