Conditionally require HTTP authentication depending on apache env variable

Question

My hosting has multiple deployments of my site (dev, stage, production). How can I add HTTP Auth headers in my htaccess file if and only if the enviornment variable that they set is equal to 'dev'? (meaning they set a variable called SITE_ENVIRONMENT that can be dev, stage, or prod depending on which site you're accessing.

PS. I'm familiar with requiring authorization from htaccess in vanilla ways, but I'm totally lost when it comes to evaluating variables or writing a block based on the outcome.

Related question: How to do conditional .htaccess password protect — Simon E.
– Simon E., Commented Sep 23, 2016 at 4:09

aowie1 · Accepted Answer · 2012-06-14 20:00:26Z

16

You can use SetEnvIf to pattern match the domain and determine which environment to use.

SetEnvIfNoCase Host ^dev.domain.com$ is_on_dev_site

AuthType Basic
AuthName "Protected Login"
AuthUserFile /path/to/.htpasswd
AuthGroupFile /dev/null
Require valid-user
Deny from env=is_on_dev_site
#allow something like API usage to bypass
SetEnvIf Request_URI "(/api/.(.*))$" allow
Order deny,allow
Allow from env=allow
Satisfy any

Man: http://httpd.apache.org/docs/2.2/mod/mod_setenvif.html

edited Jun 14, 2012 at 20:00

answered Jun 14, 2012 at 19:40

aowie1

8468 silver badges21 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

w ian douglas · Accepted Answer · 2011-05-01 00:29:32Z

-1

I'm not sure this is possible.

Theoreticaly, you can use:

RewriteCond %{ENV:SITE_ENVIRONMENT} ^dev$

to determine which environment you're in, but I can't think of how to write the RewriteRule to force a basic auth... unless you redirected to another page which handles the basic auth and resets the SITE_ENVIRONMENT variable to "dev-authenticated" or something.

answered May 1, 2011 at 0:29

w ian douglas

4,3462 gold badges36 silver badges35 bronze badges

2 Comments

w ian douglas Over a year ago

I confirmed this by chatting with some apache devs. There's no way to write a RewriteRule to trigger a basic auth, so you'll have to think of another approach.

Jay Over a year ago

ah, I see, thanks for the reply. After posting this, I reconsidered my approach, and since the different environments are deployed from a svn repository, I just made a dev site branch.

Collectives™ on Stack Overflow

Conditionally require HTTP authentication depending on apache env variable

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related