I have the following .htaccess file with basic auth and URL rewriting. I need to disable basic auth for a specific path (e.g., '/openaccess'), yet the rewriting happens first, so I can't disable the auth with SetEnvIf. The closest thing I've found is this answer, but it doesn't work for me on Apache 2.4.34.
RewriteEngine On
RewriteBase /
RewriteRule ^index\.html$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule . /index.html [L]
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /path/to/.htpasswd
Require valid-user
The following seems to work:
RewriteEngine On
RewriteBase /
RewriteRule ^index\.html$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-l
RewriteRule . /index.html [L]
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /path/to/.htpasswd
SetEnvIf Request_URI /openaccess noauth=1
<RequireAny>
Require env noauth
Require env REDIRECT_noauth
Require valid-user
</RequireAny>