How to grant access to sublocations when root location is protected by htauth in Apache 2.4

Question

I have the following site configuration

<Location />
    AuthUserFile /path/.htpasswd
    AuthName "Restricted Area"
    AuthType Basic
    require valid-user
</Location>

which restricts access to all locations. Now I want to exclude say media/

<Location /media>
    Require all granted
</Location>

and also upload/ which is in another directory

Alias /upload/files/ /another/path/upload/files/
<Directory "/another/path/upload/files/">
    Options None
    AllowOverride None
    ForceType text/plain

    Require all granted
</Directory>

Unfortunately it still prompts me for authentication.

Try putting Location /media before Location /. For /upload/files, you have no Location, so it may take the specs of Location /. — Gerard H. Pille, Apr 23 '18 at 13:50
Still having the same result. It's prompting for user and pass. — Aley, Apr 24 '18 at 08:04
Well, with only a couple of extracts from your Apache configuration, it's hard to guess what's wrong with it. The config could even be OK, but you forgot to reload it, there could be a cache between your browser and Apache, or your browsers cache itself, you may be addressing another server ... — Gerard H. Pille, Apr 24 '18 at 08:24
This part should be sufficient. You can reproduce it. Somehow `Require all granted` is not working here. Maybe some other flags like `AllowOverride AuthConfig` are missing here. Not sure. — Aley, Apr 25 '18 at 06:32

score 1 · Answer 1 · answered Apr 23 '18 at 13:51

1

You can add the exceptions in the following way:

<Directory /media>
         Options none
         AllowOverride none
         Require all granted
</Directory>

After the configuration is applied the apache service must be restarted.

answered Apr 23 '18 at 13:51

GeorgiY

21
2

The -Direktive in this notation receives a full path. Check out the [docs](https://httpd.apache.org/docs/2.4/mod/core.html#directory). So Im not sure what your suggestion is about. – Aley Apr 24 '18 at 08:02

score 1 · Answer 2 · answered Apr 25 '18 at 10:47

1

As Location /media came after Location /, it inherited roots AuthType. You should be able to overrule it:

<Location /media>
  AuthType None
  Require all granted
</Location>

answered Apr 25 '18 at 10:47

Gerard H. Pille

2,569
1
13
11

score 0 · Answer 3 · answered Apr 25 '18 at 06:29

I found a way to accomplish this

<Location />
    AuthUserFile /path/.htpasswd
    AuthName "Restricted Area"
    AuthType Basic
    Require expr %{REQUEST_URI} =~ m#^/media#
    Require expr %{REQUEST_URI} =~ m#^/upload/files/#
    Require valid-user
</Location>

There might be other options.

How to grant access to sublocations when root location is protected by htauth in Apache 2.4

3 Answers3