Search code examples
.htaccesssubdomain.htpasswd

How to make htaccess demand a password on one domain (or IP) but not another

I have a website that works like this:

  • dev.website.com (hosted @ 1.1.1.1)
  • phil.website.com (hosted @ 1.1.1.2)
  • www.website.com (hosted @ 1.1.1.3 & 1.1.1.4 served from load balancer @ 1.1.1.5)

They all use file that has these lines:

AuthType Basic
AuthName "Password Protected Area"
AuthUserFile /var/www/vhosts/website.com/.htpasswd
Require valid-user

I want to make it so that there is no password required for users looking at the load balancer. How do I accomplish this?

Solution

  • Use mod_envif directives:

    SetEnvIf Remote_Addr ^(1\.1.\1\.3|1\.1.\1\.4)$ NO_AUTH

AuthType Basic
AuthName "Password Protected Area"
AuthUserFile /var/www/vhosts/website.com/.htpasswd
Require valid-user

Satisfy    any
Order      deny,allow
Deny from  all
Allow from env=NO_AUTH