In /public_html/.htaccess, I've got rewrite rules as follows:
RewriteRule ^(subdir1)($|/) - [L]
RewriteRule ^(subdir2)($|/) - [L]
RewriteCond %{HTTP_HOST} ^(www.)?example.com$ [NC]
RewriteRule ^(.*)$ /www.example.com/$1 [L]
So, if a visitor goes to the url http://www.example.com/subdir1 (or subdir2), it will serve up the files from /public_html/subdir1 (or subdir2). Otherwise, it will 'default' to the files in /public_html/www.example.com. This works as intended.
However, if I place an .htaccess & associated .htpasswd file in /public_html/subdir1:
AuthType Basic
AuthName "Private"
AuthUserFile "/public_html/subdir1/.htpasswd"
require valid-user
...the RewriteRules suddenly break. Visiting http://www.example.com/subdir1 no longer serves up files from subdir1, instead returning a 404 from the CMS located in public_html/www.example.com/.
What gives? Why would adding a password to subdir break the parent's rewriterules?