.htaccess / .htpasswd bypass if at a certain IP address

Question

Is it possible to have an .htaccess/.htpasswd access control setup for a given directory, but if they are from a specific IP address, bypass the login/password authentication?

I know you can do something like this in the .htaccess file:

order deny,allow
deny from all
allow from 000.000.000.000

But if you add something along these lines:

AuthType Basic
AuthName "restricted area"
AuthUserFile /path/to/.htpasswd
require valid-user

Then it prompts for the password. Is there any way to do an if/else type setup, or some other solution so that users as a given IP (or set of IPs) don't get prompted for a password, but everyone else does?

Which apache version are you running? – Seybsen May 02 '12 at 18:33 — Seybsen, May 02 '12 at 18:33
Anyone have any solutions for Apache 2.2.x? – Keefer May 03 '12 at 13:44 — Keefer, May 03 '12 at 13:44

j5Dev · Accepted Answer · 2012-05-14T13:36:14.550

For versions 2.2.X you can use the following...

AuthUserFile /var/www/mysite/.htpasswd
AuthName "Please Log In"
AuthType Basic
require valid-user
Order allow,deny
Allow from xxx.xxx.xxx.xxx
satisfy any

Obviously replace the path to your usersfile and the ip address which you would like to bypass the authentication.

Further explanation of the specifics, can be found at: http://httpd.apache.org/docs/2.2/howto/auth.html

Seybsen · Answer 2 · 2014-12-22T15:40:26.177

25

If you use apache >=2.4, it would be something like this:

<If "%{REMOTE_ADDR} != '127.0.0.1'">
  AuthType Basic
  AuthName "restricted area"
  AuthUserFile /path/to/.htpasswd
  require valid-user
</If>

For more info take a look at the docs.

edited Dec 22 '14 at 15:40

answered May 02 '12 at 18:41

Seybsen

14,989
4
40
73

Unfortunately, looks like the server is running Apache 2.2.19 – Keefer May 02 '12 at 19:23
1

Works perfectly for me (Apache/2.4.10 (Debian)). Thanks ! – Apr 13 '17 at 07:40
1

You can also use network notation instead of literal addresses: `` – mivk Dec 10 '18 at 13:35

score 17 · Answer 3 · edited Jul 22 '15 at 07:45

17

I am running Apache/2.2.16 (Debian), and had a similar problem, I solved it like this:

(This can be run in both an .htaccess file or directly in the virtualhost under <Location/>)

Order deny,allow
Deny from all
AuthType Basic
AuthUserFile /home/somesite/.htpasswd
AuthName "No entry, unless"
Require Valid-user
Allow from x.x.x.x
Allow from x.x.x.x
Satisfy Any

I allowed entry without password from two different ip, and the rest must enter password to enter.

edited Jul 22 '15 at 07:45

MrWhite

43,179
8
60
84

answered Oct 01 '13 at 03:16

Sverre

1,318
13
21

2

Thanks a lot, I was trying this inside a `` part helped me out a great deal. – chmac May 15 '14 at 12:14
works for 2.4 as well, thanks – Gurpreet Singh Jun 22 '23 at 12:22

score 16 · Answer 4 · answered Aug 14 '18 at 08:18

16

Apache 2.4 compatible:

AuthType Basic
AuthUserFile /www/.htpasswd
AuthName "Protected Area"

<RequireAny>
    Require ip 1.2.3.4
    Require valid-user
</RequireAny>

See the migration guide Upgrading to 2.4 from 2.2 for more examples.

answered Aug 14 '18 at 08:18

DrDol

2,220
2
19
23

This one works best for me in apache 2.4.x and is a life saver, given that I've a lot of IPs to Require (about 60 ip ranges) o its a way better syntax than the one from NicoMinsk with the if/elseIf/else – Eric Mar 25 '20 at 15:36

score 7 · Answer 5 · answered Jan 25 '18 at 15:28

If you use apache >=2.4, and you want to allow a set of IP, as asked in initial question, you can do it like this :

   <If "-R '192.168.0.0/24'">
            Require all granted
    </If>
    <ElseIf "-R '192.168.1.0/24'">
            Require all granted
    </ElseIf>
    <Else>
            AuthType Basic
            AuthName "restricted area"
            AuthUserFile /etc/apache2/.htpasswd
            require valid-user
    </Else>

score 2 · Answer 6 · answered Mar 12 '13 at 13:38

2

In addition to the answer of j5Dev:

# Interne IP-Adressen
SetEnvIf Remote_Addr "^127\.0\.0\.1$" IsIntern
SetEnvIf Remote_Addr "^192\.168" IsIntern
# .. add more IP addresses or ranges here

# Authentication, wenn nicht intern
AuthUserFile /path/to/.htpasswd
AuthName "restricted area"
AuthType Basic
require valid-user
Order allow,deny
Allow from env=IsIntern
satisfy any

answered Mar 12 '13 at 13:38

hollodotme

21
1

1

None of the answers on this page work for me with the "satisfy any" directive, which is probably pretty important :) Is there anything else that needs configuring? I am on Apache 2.2.22. – Charlie Schliesser Mar 29 '13 at 16:25

.htaccess / .htpasswd bypass if at a certain IP address

6 Answers6

Linked