Authentication when HTTPS

Robert Ionescu wrote:

>Gertjan Klein wrote:
>>
>> Is there a way to tell Apache to use (basic) athentication *only* when
>> an HTTPS connection is made?
>
>This should be spoosible, if you're placing the authentication
>directives inside of a <directory /path/to/protect> within your
><virtualhost ...:443> section.

Excellent, that works. Thanks very much. One additional question: my
VirtualHost ...:443 section is in a global configuration file. I have
altered this file for the site I want to protect, and that works fine.
However, I would prefer it if I could protect this particular directory
from an .htaccess file. Multiple VirtualHost declarations are apparently
not merged (Apache tells me that the first one takes precedence). Is
there a way to have this configuration in an .htaccess file? (If not,
I'll live with it, no problem .

Thanks again,
Gertjan.
--
Gertjan Klein <gklein.DeleteThis@xs4all.nl>
 >> Stay informed about: Authentication when HTTPS 

Gertjan Klein wrote:
> Robert Ionescu wrote:
>
>> Gertjan Klein wrote:
>>> Is there a way to tell Apache to use (basic) athentication *only* when
>>> an HTTPS connection is made?
>> This should be spoosible, if you're placing the authentication
>> directives inside of a <directory /path/to/protect> within your
>> <virtualhost ...:443> section.
[...]
> However, I would prefer it if I could protect this particular directory
> from an .htaccess file.

The .htaccess file is read by each request, regardless if you're
requesting the site via the http or https protocol. But you can't define
a conditional statement like
"only https" -> require valid-user

This is not possible. Even if the require directive would support a
second argument "env=env-variable" like the allow/deny directive does,
the problem would be to set some ENV. This could be done with
mod_rewrite and a condition which checks for https, but authorization
comes before mod_rewrite acts in per-dir context (.htaccess files).

If you need the protection for some more virtualhosts, try to place it
into a separate file and include it in each <virtualhost ...>.

--
Robert
 >> Stay informed about: Authentication when HTTPS 

Robert Ionescu wrote:

>Gertjan Klein wrote:
>> However, I would prefer it if I could protect this particular directory
>> from an .htaccess file.
>
>The .htaccess file is read by each request, regardless if you're
>requesting the site via the http or https protocol. But you can't define
>a conditional statement like
>"only https" -> require valid-user

OK, thanks for the explanation. I currently have only one site where I
would like to do such a thing; if in the future I want to do this for
other sites as well I'll follow your suggestion to place these
definitions in an include file.

Thanks again for your help, regards,
Gertjan.
--
Gertjan Klein <gklein DeleteThis @xs4all.nl>
 >> Stay informed about: Authentication when HTTPS