Question

Using Apache, I force HTTPS on a folder:

SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire %{HTTP_HOST} eq "www.example.com"
ErrorDocument 403 https://www.example.com/admin/

and I protect the folder using Apache AuthBasic:

AuthType Basic
AuthName "Administration"
AuthUserFile /path/to/my/.htpasswd
Require valid-user
Satisfy all

Like this, the password is always sent over HTTPS. It works well, but then I tried to disable authentication for a single URL:

SetEnvIf Request_URI "crm/index\.php$" removeme_uri
Order deny,allow
Deny from all
Allow from env=removeme_uri
Satisfy any

This URL does not ask for authentication, and the others do. So all is well, but HTTPS is not required anymore, and the password can be sent in clear !

What am I doing wrong here ?

Answer 1

Thanks to Jon’s answer, I could try different solutions. I found this question and applied the answer to my situation:

In the main directory, the .htaccess contains

SSLOptions +StrictRequire
SSLRequireSSL
SSLRequire %{HTTP_HOST} eq "www.example.com"
ErrorDocument 403 https://www.example.com/admin/

AuthType Basic
AuthName "Administration"
AuthUserFile /path/to/my/.htpasswd
Require valid-user
Satisfy all

And in the crm subdirectory, the .htaccess has:

<FilesMatch "index\.php">
    Allow from all
    Satisfy any
</FilesMatch>

It forces the SSL in any case, and allows the access to crm/index.php.