I'm working on a project that I want to hide from the world behind Apache's basic auth whilst it's in development. The project has a PHP backend and a JS frontend on different virtual hosts. I have successfully setup basic auth on the backend and the JS application can make requests to it with the following configuration (123.456.789 being the JS application's IP address):

<Directory "/some/backend/folder">
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All

        Order allow,deny
        allow from all

        AuthType Basic
        AuthName "Restricted Content"
        AuthUserFile /some/path/.htpasswd

        <RequireAny>
                Require valid-user
                Require ip 123.456.789
        </RequireAny>
</Directory>

The JS application's virtual host proxies requests to a Node server which ultimately handles any requests to the backend, using the following configuration:

ProxyPreserveHost On
ProxyRequests On
ProxyVia On

ProxyPass / http://0.0.0.0:3000/ connectiontimeout=600 timeout=600

I also want to add basic auth to this so that the world cannot access the frontend application. I've tried adding the following:

<Proxy *>
       Order deny,allow
       Allow from all
       AuthType Basic
       AuthName "Restricted Content"
       AuthUserFile /some/path/.htpasswd
       Require valid-user
</Proxy>

Which seemed to work at first, however all the previously working requests to the backend server now 401 which is rather confusing.

Does anybody know what's going on here? Does the act of adding basic auth to the proxy frontend virtual host screw-up the RequireAny config on the backend virtual host?

Any pointers greatly appreciated! Thanks