Here's the essential part of my current configuration, where I protect my entire website using HTTP basic authentication:
<VirtualHost *:443>
<Location "/">
AuthType Basic
AuthName "Protected Area"
AuthBasicProvider file
AuthUserFile /path/to/passwords_file
Require valid-user
</Location>
</VirtualHost>
However, I want to except certain paths so they are publicly available, specifically robots.txt, favicon.ico, manifest.json. How to do this?
Adding the following configuration block after the existing Location one will except the specified paths from requiring a password:
<Location ~ "^/favicon\.ico$|^/manifest\.json$|^/robots\.txt$">
Require all granted
</Location>
This one uses a single regex matching string for all files, but you could also specify each of them individually, one at a time, without using regex:
<Location "/favicon.ico">
Require all granted
</Location>
<Location "/manifest.json">
Require all granted
</Location>
<Location "/robots.txt">
Require all granted
</Location>