.htaccess / .htpasswd bypass if at a certain IP address

.HtaccessApache2Basic Authentication

.Htaccess Problem Overview


Is it possible to have an .htaccess/.htpasswd access control setup for a given directory, but if they are from a specific IP address, bypass the login/password authentication?

I know you can do something like this in the .htaccess file:

order deny,allow
deny from all
allow from 000.000.000.000

But if you add something along these lines:

AuthType Basic
AuthName "restricted area"
AuthUserFile /path/to/.htpasswd
require valid-user

Then it prompts for the password. Is there any way to do an if/else type setup, or some other solution so that users as a given IP (or set of IPs) don't get prompted for a password, but everyone else does?

.Htaccess Solutions


Solution 1 - .Htaccess

For versions 2.2.X you can use the following...

AuthUserFile /var/www/mysite/.htpasswd
AuthName "Please Log In"
AuthType Basic
require valid-user
Order allow,deny
Allow from xxx.xxx.xxx.xxx
satisfy any

Obviously replace the path to your usersfile and the ip address which you would like to bypass the authentication.

Further explanation of the specifics, can be found at: http://httpd.apache.org/docs/2.2/howto/auth.html

Solution 2 - .Htaccess

If you use apache >=2.4, it would be something like this:

<If "%{REMOTE_ADDR} != '127.0.0.1'">
  AuthType Basic
  AuthName "restricted area"
  AuthUserFile /path/to/.htpasswd
  require valid-user
</If>

For more info take a look at the docs.

Solution 3 - .Htaccess

I am running Apache/2.2.16 (Debian), and had a similar problem, I solved it like this:

(This can be run in both an .htaccess file or directly in the virtualhost under <Location/>)

Order deny,allow
Deny from all
AuthType Basic
AuthUserFile /home/somesite/.htpasswd
AuthName "No entry, unless"
Require Valid-user
Allow from x.x.x.x
Allow from x.x.x.x
Satisfy Any

I allowed entry without password from two different ip, and the rest must enter password to enter.

Solution 4 - .Htaccess

Apache 2.4 compatible:

AuthType Basic
AuthUserFile /www/.htpasswd
AuthName "Protected Area"

<RequireAny>
    Require ip 1.2.3.4
    Require valid-user
</RequireAny>

See the migration guide Upgrading to 2.4 from 2.2 for more examples.

Solution 5 - .Htaccess

If you use apache >=2.4, and you want to allow a set of IP, as asked in initial question, you can do it like this :

   <If "-R '192.168.0.0/24'">
            Require all granted
    </If>
    <ElseIf "-R '192.168.1.0/24'">
            Require all granted
    </ElseIf>
    <Else>
            AuthType Basic
            AuthName "restricted area"
            AuthUserFile /etc/apache2/.htpasswd
            require valid-user
    </Else>

Solution 6 - .Htaccess

In addition to the answer of j5Dev:

# Interne IP-Adressen
SetEnvIf Remote_Addr "^127\.0\.0\.1$" IsIntern
SetEnvIf Remote_Addr "^192\.168" IsIntern
# .. add more IP addresses or ranges here

# Authentication, wenn nicht intern
AuthUserFile /path/to/.htpasswd
AuthName "restricted area"
AuthType Basic
require valid-user
Order allow,deny
Allow from env=IsIntern
satisfy any

Attributions

All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionKeeferView Question on Stackoverflow
Solution 1 - .Htaccessj5DevView Answer on Stackoverflow
Solution 2 - .HtaccessSeybsenView Answer on Stackoverflow
Solution 3 - .HtaccessSverreView Answer on Stackoverflow
Solution 4 - .HtaccessDrDolView Answer on Stackoverflow
Solution 5 - .HtaccessNicoMinskView Answer on Stackoverflow
Solution 6 - .HtaccesshollodotmeView Answer on Stackoverflow