Home / server / Questions / 136945
Accepted
Tom
Asked: 2010-04-30 01:32:22 +0800 CST

htaccess allow if does not contain string

  • 772

I'm trying to setup a .htaccess file which will allow users to bypass the password block if they come from a domain which does not start with preview. e.g. http://preview.example.com would trigger the password and http://example.com would not.

Here's what I've got so far:

SetEnvIfNoCase Host preview(.*\.)? preview_site
AuthUserFile /Users/me/.htpasswd
AuthGroupFile /dev/null
AuthType Basic
AuthName "Development Area"
Require valid-user
Order deny,allow
Allow from 127
deny from env=preview_site
Satisfy any

Any ideas?

apache-2.2 password .htaccess

1 Answers

  1. Best Answer

    You where almost there, a couple of points:

    Your regex though valid, also matches when preview in somewhere else in the URL (eg. test.preview.example.com). The following only matches if the URL starts with "preview."

    SetEnvIfNoCase Host ^preview\. preview_site

    The order needs to change to "Allow,Deny", because you want mod_access to fail when both Deny and Allow statements match. After mod_access fails the mod_auth will be called because of the "Satify Any".

    So this should provide the behavior you are looking for:

    SetEnvIfNoCase Host ^preview\. preview_site
AuthUserFile /Users/me/.htpasswd
AuthGroupFile /dev/null
AuthType Basic
AuthName "Development Area"
Require valid-user
Order Allow,Deny
Allow from All
Deny from env=preview_site
Satisfy Any
    • 2