My website isn't live yet and I want to be the only one who can access it. Up to this point, I just denied from all and allowed my ip. The problem is I'm not at home right now and I don't have an internet connection other than mobile. My guess is that my current ip from the mobile network is shared among many other people, so white listing this ip is something I'd not like to risk. Perhaps I could set a custom user agent that would act like a password? But then how would I configure apache to allow only from specific UA? Are there any other options?
Edit: Apache authentication works, but I have problem with making cross origin ajax requests. My web application requires to make ajax requests to my server. The application is distributed, not hosted so I allow all origins to my endpoint. Apache authentication somehow breaks it for me, "no access-control-allow-origin" header is present... origin localhost is therefore not allowed access.
Edit2: It doesn't work even with PayPal! Are there any better solutions?
Edit:3 I found a better solution. It works with my web app and visitors won't see a login form. Simply set a custom header to be sent with each request. I used Requestly Chrome extension for that (also allows to specify which urls should have custom headers sent). Then in vhost file:
SetEnvIf X-MY-TOKEN "secretmessage" AllowIp Require all denied Require ip some.ip Require host paypal.com Require env AllowIp
However PayPal IPN still won't work. I have also tried wrapping it in . I guess I have to whitelist my ip for a moment and see if it works.
Edit4: PayPal works now, they have some technical issues at sandbox.paypal.com