I want to make the contents of the directory
/srv/www/dssx (mostly) public. The sub-directory
/srv/www/dssx I want to protect with basic authentication. However, I cannot get it to work: all the configurations I have tried allow public access to the sub-directory without requiring basic auth. Here is my configuration:
# Running under Apache 2.4.38 DocumentRoot /srv/www/dssx # Allow unrestricted access to all XML and PEM files. <Directory "/srv/www/dssx"> Require all denied <FilesMatch "\.(pem|xml)$"> Require all granted </FilesMatch> </Directory> # We require Basic Auth (username and password) for this sub-directory <Directory "/srv/www/dssx/basic-auth"> AuthType Basic AuthName "DSSX Restricted Content" AuthBasicProvider file AuthUserFile /etc/apache2/dssx-restricted-auth Require valid-user </Directory>
With the above, the URL
https://example.com/basic-auth/test.xml is served without requiring basic authentication, whereas I want that URL to require basic authentication.