Search code examples
.htaccessapache2basic-authentication

.htaccess / .htpasswd bypass if at a certain IP address


Is it possible to have an .htaccess/.htpasswd access control setup for a given directory, but if they are from a specific IP address, bypass the login/password authentication?

I know you can do something like this in the .htaccess file:

order deny,allow
deny from all
allow from 000.000.000.000

But if you add something along these lines:

AuthType Basic
AuthName "restricted area"
AuthUserFile /path/to/.htpasswd
require valid-user

Then it prompts for the password. Is there any way to do an if/else type setup, or some other solution so that users as a given IP (or set of IPs) don't get prompted for a password, but everyone else does?


Solution

  • For versions 2.2.X you can use the following...

    AuthUserFile /var/www/mysite/.htpasswd
    AuthName "Please Log In"
    AuthType Basic
    require valid-user
    Order allow,deny
    Allow from xxx.xxx.xxx.xxx
    satisfy any
    

    Obviously replace the path to your usersfile and the ip address which you would like to bypass the authentication.

    Further explanation of the specifics, can be found at: http://httpd.apache.org/docs/2.2/howto/auth.html