How to make Basic Auth exclude rewritten url

Question

I have basic authentication on a development server. It is configured inside my httpd.conf file for the VirtualHost website. I had to configure it to exclude certain directories, which did not cause any problems, and everything worked fine.

The problem was to exclude the URL that went through my mod_rewrite rules in the .htaccess file. My setup is that I have all the URLs going through my index.php file, and from there the corresponding code is found and run. I tried adding the URL that I wanted to exclude ( /businesses/upload_logo ), as I did others, but it still requires authentication. This is what I have now:

 ... <Location /> SetEnvIf Request_URI "/businesses/upload_logo" noauth=1 SetEnvIf Request_URI "/api/.*" noauth=1 AuthType Basic AuthName "Private" AuthUserFile **** Require valid-user Order deny,allow Satisfy any Deny from all Allow from env=noauth </Location> .... 

I found questions similar to mine here and here , but the answers only give me what I'm already trying.

I also thought about possible other solutions, but this will be the last resort. I want to see if it is possible, as I do it now:

• Configure basic auth inside my php code instead
  • Too much trouble at the moment
• Put authentication in my .htaccess file
  • I did not want to do this yet, because I want authentication to take place on one of the 3 servers. I know that I could use a few more SetEnvIf HOST ... but I am looking to see if this can be fixed this way or not the first.

The mod_rewrite rule:

 ... RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule (.*) index.php [L,QSA] 

Answer 1

Try to add

 Allow from env=REDIRECT_noauth 

Answer 2

For me, something like this works like a charm:

 <location /> SetEnvIf Request_URI "/businesses/upload_logo" REDIRECT_noauth=1 AuthType Basic AuthName "Restricted Files" AuthUserFile /etc/httpd/passwords/passwords Order Deny,Allow Satisfy any Deny from all Allow from env=REDIRECT_noauth Require user yournickname </location> 

Answer 3

based on what you gave, it should work if there is no conflicting directive in your configuration.

I did a similar working setup, I just used the path to the file system instead of the URI

I am adding it here, hoping you can find it useful.

 <VirtualHost *:8989 > <IfModule mod_auth_basic.c> <Directory /var/www/html/vella-8989> # the auth block AuthType Basic AuthName "Please login." AuthUserFile /var/www/html/vella-8989/.htpasswd require valid-user Order Deny,Allow Satisfy any Deny from all Require valid-user Allow from env=noauth </Directory> </IfModule> # set an environtment variable "noauth" if the request has "/callbacks/" SetEnvIf Request_URI "/callbacks/" noauth=1 ServerName vella.com ServerSignature off </VirtualHost>