Home / server / Questions / 46575
Accepted
Guillaume
Asked: 2009-07-28 08:22:38 +0800 CST

Apache authentication : allow public access to a subdirectory

  • 772

This is probably a simple problem, but I cant find the solution in the documentation.

I want to password protect my website using BASIC authentication. But I want a subdirectory to be non protected :

http://mysite.com/ -> BASIC protected
http://mysite.com/somedir -> BASIC protected
http://mysite.com/someotherdir -> BASIC protected
http://mysite.com/public -> not protected

I have no problem protecting all the site, but I dont know how I can "unprotect" one directory. The site is hosted on a shared host, so I only have access to .htaccess files to do the configuration.

Is there a directive to negate the authentication ?

Thanks for the help ...

apache-2.2 authentication

4 Answers

  1. Best Answer

    Shouldn't be a problem with .htaccess, depending on what the host has allowed.

    You could try putting a .htaccess in the sub-folder with the following, although overrides will have to be enabled for the directories it's in.

     Allow From All
 Satisfy Any
    • 10

  2. OK, for a path server.com/private/public:

    server.com/private/.htaccess

    AuthType Basic
AuthName "Private, keep out."
Require...

    server.com/private/public/.htaccess

    Allow From All
Satisfy Any

    The key here is 'Satisfy Any' which ORs the requirements from upstream together. 'Satisfy All' is the default.

    • 7

  3. I believe this might do it:

    # put the global auth stuff here
...

# put the override here
<Location /public>
Allow from All
Satisfy Any
</Location>
    • 1

  4. I managed to solve this doing this:

    <Directory "/path/to/maindirectory">
[... auth stuff ... ]
</Directory>

<Directory "/path/to/mysubdirectory">
 Allow from All
 Satisfy Any
</Directory>

    Do NOT use Locations, because they're made to be case sensitive and they do not act on actual folder access, but just over the URL.

    So, for instance, if I write

    http:/mywebsite/STUFF

    or

    http://mywebsite/stuff

    or

    http://mywebsite/StUfF

    it's different for Location control, even if the physical directory called is the same!!!

    In short, you check access for directory "stuff" and I can get in writing it with different case.

    Also, using .htaccess file in single directory with location control on others did not work to me.

    Hope it helps.

    • 1