I have a deployment with apache 2.2.22 server behind varnish.

What I would like to accomplish is that password protect a directory with htpasswd but make this accessible for certain users coming from ips without authentication.

AuthType Basic
AuthName "test"
AuthUserFile /www/.htpasswd
Require valid-user
order deny,allow 
deny from all 

SetEnvIF X-Forwarded-For "" AllowIP
Allow from env=AllowIP 
Satisfy any 

What I do right now is this, it is a workaround but it is working. If the X-Forwarded-For IP (the client) is then let him watch the page without authentication.

The problem with this that it is insecure, the client can just set an X-Forwareded-For header and bypass authentication.

I have tried the Apache RPAF module:

<IfModule rpaf_module>
RPAFenable On
RPAFsethostname On
RPAFproxy_ips varniship

Which theoretically should restrict the X-Forwarded-For requests coming from the proxy, I'm not even sure that I need this module in this case since the proxy will always put the X-Forwarded-For client ip behind it's. So the req would look like:

X-Forwarded-For: <varniship>, clientip

Where the clientip can be manipulated by the client once again. Is there a better way to do this?

    <Directory "/var/www/html/docroot">
    AuthName "Restricted Access"
    AuthType Basic
    AuthUserFile /usr/local/.htpasswd
    Order allow,deny
    Allow from x.x.x.x
    Require  valid-user
    Options Indexes FollowSymLinks
    satisfy any

This works like a charm for me though I'm on 2.4.10 and don't have an older one to test.

  • It would work if the machine wouldn't be behind a varnish cache server. In this case it will only see the requests coming from the varnish cache so allow from will not work.
    – defiler
    Feb 2 '16 at 12:46

Alternatively you could do this also on Varnish vcl side:

    sub vcl_recv {
        # whitelist ip
        if (req.http.X-Forwarded-For ~ "^10\.10\.10\.10") {
           # where dXNlcjpwYXNzd29yZA== is user:password in base64
           set req.http.Authorization = "Basic dXNlcjpwYXNzd29yZA==";

Can be extended with other checks coming from request header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.