3

I want to make the contents of the directory /srv/www/dssx (mostly) public. The sub-directory /srv/www/dssx/basic-auth of /srv/www/dssx I want to protect with basic authentication. However, I cannot get it to work: all the configurations I have tried allow public access to the sub-directory without requiring basic auth. Here is my configuration:

# Running under Apache 2.4.38
DocumentRoot /srv/www/dssx

# Allow unrestricted access to all XML and PEM files.                                                                                                 
<Directory "/srv/www/dssx">
  Require all denied
  <FilesMatch "\.(pem|xml)$">
    Require all granted
  </FilesMatch>
</Directory>

# We require Basic Auth (username and password) for this sub-directory                                                            
<Directory "/srv/www/dssx/basic-auth">
  AuthType Basic
  AuthName "DSSX Restricted Content"
  AuthBasicProvider file
  AuthUserFile /etc/apache2/dssx-restricted-auth
  Require valid-user
</Directory>

With the above, the URL https://example.com/basic-auth/test.xml is served without requiring basic authentication, whereas I want that URL to require basic authentication.

1
  • Any reason you are doing this in Apache conf files rather than creating a .htaccess file in the directory? Apr 30 '20 at 23:49
2

It turned out that I needed to put a matching FilesMatch element in the subdirectory configuration section:

# We require Basic Auth (username and password) for this sub-directory                                                            
<Directory "/srv/www/dssx/basic-auth">
  <FilesMatch "\.(pem|xml)$">
    AuthType Basic
    AuthName "DSSX Restricted Content"
    AuthBasicProvider file
    AuthUserFile /etc/apache2/dssx-restricted-auth
    Require valid-user
  </FilesMatch>
</Directory>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.