1

The below code is in .htaccess file in /home/cuddle/test/

AuthUserFile "/home/cuddle/.htpasswds/test/passwd"
AuthType Basic
AuthName "Secure Area"
Require valid-user

This works fine, it will prompt for username & password, however when I add another rule to allow internal requests:

Allow from 127.0.0.1
Satisfy Any

It no longer prompts for password for outside users (non localhost) and seems to let all users through, no matter if they validate or what IP they are from. There are no other permissions/allow/deny present within .htaccess

Gary Green
  • 22,045
  • 6
  • 49
  • 75

2 Answers2

4

Try this:

AuthUserFile "/home/cuddle/.htpasswds/test/passwd"
AuthType Basic
AuthName "Secure Area"
Require valid-user
Order deny,allow
Deny from all
Allow from 127.0.0.1
Allow from ::1
Satisfy Any

I just signed up to StackOverflow because I stumbled to same problem, and after trial-and-error, the config above worked for me.

adijiwa
  • 194
  • 1
  • 7
1

Simpler solution:

AuthUserFile "/home/cuddle/.htpasswds/test/passwd"
AuthType Basic
AuthName "Secure Area"
Require valid-user
Require local
Satisfy Any
Leo
  • 10,407
  • 3
  • 45
  • 62