I am trying to password protect a website only if it is the dev site using .htaccess and .htpasswd

I am using Apache 2.4.29 on Ubuntu 18.04

Here is what I have in the .htaccess file

<If "%{HTTP_HOST} == 'dev.randy.dev'">
  AuthUserFile "/home/randy/.htpasswd"
  AuthType Basic
  AuthName "dev"
  require valid-user

I confirmed that the password protection lines do indeed work outside of the IF.

When I try to run the above I get the apache internal server error. I have checked the main apache error.log as well as the virtualhost error log and nothing is being reported in either.

Is it possible to do what I am trying to do or should I go about it another way?

  • What exactly is the error that you are getting? You mention it but didn't tell us what it is/was. – Dave Apr 25 '19 at 12:52
  • 1
    These directives look syntactically valid, so it's not clear what would be triggering the error. If you are getting a 500 Internal Server Error then you would expect an error to be logged somewhere (providing error logs are configured) - which is another mystery. Do you get the error regardless of which hostname you access the site through? – MrWhite Apr 27 '19 at 0:29
  • Do you have any other directives in your .htaccess file? What is the AllowOverride directive set to in your <VirtualHost>? – MrWhite May 8 '19 at 0:24
  • My apologies for not getting back to everyone sooner. It turns out the dev server I was testing this on did not have the required version of Apache. I think I checked my local apache version when drafting the question but then tested on a server that had Apache 2.2. – Randy Johnson May 13 '19 at 12:05
  • @RandyJohnson And Apache expressions don't exist on Apache 2.2 (hence the error). So, is your query now resolved? – MrWhite May 22 '19 at 11:24