.htaccess / .htpasswd bypass if at a certain IP address

Question

Is it possible to have an .htaccess/.htpasswd access control setup for a given directory, but if they are from a specific IP address, bypass the login/password authentication?

I know you can do something like this in the .htaccess file:

order deny,allow deny from all allow from 000.000.000.000 

But if you add something along these lines:

AuthType Basic AuthName "restricted area" AuthUserFile /path/to/.htpasswd require valid-user 

Then it prompts for the password. Is there any way to do an if/else type setup, or some other solution so that users as a given IP (or set of IPs) don't get prompted for a password, but everyone else does?

Answer 1

For versions 2.2.X you can use the following...

AuthUserFile /var/www/mysite/.htpasswd AuthName "Please Log In" AuthType Basic require valid-user Order allow,deny Allow from xxx.xxx.xxx.xxx satisfy any 

Obviously replace the path to your usersfile and the ip address which you would like to bypass the authentication.

Further explanation of the specifics, can be found at: http://httpd.apache.org/docs/2.2/howto/auth.html

Answer 2

If you use apache >=2.4, it would be something like this:

<If "%{REMOTE_ADDR} != '127.0.0.1'">   AuthType Basic   AuthName "restricted area"   AuthUserFile /path/to/.htpasswd   require valid-user </If> 

For more info take a look at the docs.