Search code examples
.htaccessconditional-statementspasswdsetenvifdefine

How to do conditional .htaccess password protect


I'm trying to password protect a specific url using a .htaccess. Different urls point to the same files but have different workings. I now need to password protect only one url. I'm trying to do this using setenvif but it doesn't seem to work. I might not fully understand the purpose or use of the apache setenv module.

This is my code what doesn't seem to work

SetEnvIfNoCase Host "topasswordprotect\.domain\.com$" protecturl
<IfDefine protecturl>
  Require valid-user
  AuthName "Please enter your name and password"
  AuthType Basic
  AuthUserFile .htpasswd
</IfDefine>

Solution

  • I finally figured it out. I indeed had to use the mod_rewrite engine. I was determined to have a solution which didn't involve me having to make extra files or directories.

    Same files, no extra directories, one .htaccess:

    # Case we are in the protected area!
    RewriteCond %{REQUEST_FILENAME} index.php [OR]
    RewriteCond %{REQUEST_FILENAME} !-f [OR]
    RewriteCond %{REQUEST_URI} ^(\/){1}$
    RewriteCond %{REQUEST_FILENAME} !-d [OR]
    RewriteCond %{REQUEST_URI} ^(\/){1}$
    RewriteCond %{HTTP_HOST} ^(protected)\.mydomain\.com$
    RewriteRule ^(.*)$ admin.php%{REQUEST_URI} [L]
    
    #default rewrite
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*)$ index.php/$1 [L]
    
    #only protect access to admin.php which is a symlink to index.php
    <FilesMatch "admin.php">
      AuthUserFile .htpasswd
      AuthName EnterPassword
      AuthType Basic
      require valid-user
    </FilesMatch>