0

I configure the authentication for my webspace via a .htaccess file (I have no control over the httpd.conf file). For a secure implementation I have an automatic redirection of HTTP to HTTPS via

RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R=307,L]

For authentication I use the following lines

AuthType Basic
AuthName name
AuthUserFile ..path-to-htpasswd..
require valid-user

If I visit a resource via http, I have to type the user and password two times (first to get the 307-Redirection and the second time to get the actual document). Is there a way to apply authentication only for HTTPS-Request? So a HTTP request directly gets the redirection so that I would have to authenticate myself only once.

Greetings and thanks for your answers

1 Answer 1

1

You should be able to take advantage of the fact that rewrites get processed before files are served with:

RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [R=307,L]

<FilesMatch ".">
    AuthType Basic
    AuthName name
    AuthUserFile ..path-to-htpasswd..
    require valid-user
</FilesMatch>

. is a regex wildcard so auth still applies to all valid request, but only after the rewrite occurs

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.