In Apache make subdirectory require basic authentication while parent directory is open to the public

Question

I want to make the contents of the directory /srv/www/dssx (mostly) public. The sub-directory /srv/www/dssx/basic-auth of /srv/www/dssx I want to protect with basic authentication. However, I cannot get it to work: all the configurations I have tried allow public access to the sub-directory without requiring basic auth. Here is my configuration:

# Running under Apache 2.4.38
DocumentRoot /srv/www/dssx

# Allow unrestricted access to all XML and PEM files.                                                                                                 
<Directory "/srv/www/dssx">
  Require all denied
  <FilesMatch "\.(pem|xml)$">
    Require all granted
  </FilesMatch>
</Directory>

# We require Basic Auth (username and password) for this sub-directory                                                            
<Directory "/srv/www/dssx/basic-auth">
  AuthType Basic
  AuthName "DSSX Restricted Content"
  AuthBasicProvider file
  AuthUserFile /etc/apache2/dssx-restricted-auth
  Require valid-user
</Directory>

With the above, the URL https://example.com/basic-auth/test.xml is served without requiring basic authentication, whereas I want that URL to require basic authentication.

Answer 1

It turned out that I needed to put a matching FilesMatch element in the subdirectory configuration section:

# We require Basic Auth (username and password) for this sub-directory                                                            
<Directory "/srv/www/dssx/basic-auth">
  <FilesMatch "\.(pem|xml)$">
    AuthType Basic
    AuthName "DSSX Restricted Content"
    AuthBasicProvider file
    AuthUserFile /etc/apache2/dssx-restricted-auth
    Require valid-user
  </FilesMatch>
</Directory>