Re: Auth failure when a rewrite rule is moved out to an htaccess file

On 7/21/25 7:06 PM, EML wrote:
> I have a problem where authorisation behaves differently when a rewrite 
> rule is moved from the main configuration to an .htaccess file. Any 
> advice appreciated.
> 
> The site looks like this:
> 
> $ tree /var/www5
> /var/www5
> |-- dir1
>      |-- test1.html
> |-- dir2
> |   |-- test2.html
> |-- index.html
> |-- passwords
> 
> I want the site to default to requiring a login, except that dir1/ 
> test1.html should be readable by anybody. There's a complication, which 
> is that a rewrite rule sets the home page to dir1/test1.html, rather 
> than index.html. So the expected HTTP status codes are:
> 
> http://localhost/                 200 (because of the rewrite)
> http://localhost/index.html       401
> http://localhost/dir1/test1.html  200
> http://localhost/dir2/test2.html  401
> 
> This configuration works exactly as expected:
> 
> <VirtualHost *:80>
>    DocumentRoot /var/www5
> 
>    <Location />
>      AuthType Basic
>      AuthName Test
>      AuthBasicProvider file
>      AuthUserFile "/var/www5/passwords"
>      Require  valid-user
>    </Location>
> 
>    <Directory /var/www5/dir1>
>      <If true>
>        Require all granted
>      </If>
>    </Directory>
> 
>    RewriteEngine On
>    RewriteRule ^(/)?$ /dir1/test1.html [L]
> </VirtualHost>
> 
> Ok, here's the problem: I actually need to move the rewrite out to 
> an .htaccess file, so I've moved the RewriteEngine and RewriteRule lines 
> out to /var/www5/.htaccess. The new configuration file looks like:
> 
> <VirtualHost *:80>
>    DocumentRoot /var/www5
> 
>    <Location />
>      AuthType Basic
>      AuthName Test
>      AuthBasicProvider file
>      AuthUserFile "/var/www5/passwords"
>      Require  valid-user
>    </Location>
> 
>    <Directory /var/www5>
>      AllowOverride All
>    </Directory>
> 
>    <Directory /var/www5/dir1>
>      <If true>
>        Require all granted
>      </If>
>    </Directory>
> </VirtualHost>
> 
> This *doesn't* work. What I get now is:
> 
> http://localhost/                 401
> http://localhost/index.html       401
> http://localhost/dir1/test1.html  200
> http://localhost/dir2/test2.html  401
> 
> I now have to log in to visit http://localhost/. The rewrite does work; 
> if I log in, I get the dir1/test1.html page.
> 
> Thanks.
> 

-- 
.htaccess is evaluated after virtualhost, so before you reach the 
directory, the basic auth kicks in.

Perhaps at virtualhost you should keep some kind of default redirect 
towards directories where you use .htaccess.

Or have a more specific path to set basic authentication in, since If I 
understand correctly you do not want to have to auth in /, you want to 
be redirected.

-Daniel
Find help at #httpd in Libera.chat