1

I have setup Basic Auth for an Opencart project for browser authentication to allow access to relevant users only. Now, I need to use REST API for a mobile app. When I call an endpoint from the API to get some details from Opnecart Project it requires an access_token to be generated from API and by using that access_token with every request, I can get details from the API. The problem is Basic Auth that I have setup for project and because of that I cannot access API as I can only use 1 method to access the API that is GET method to get the details from opencart, I cannot use 2 methods i.e. Auth Header and GET methods. So, what I am trying to do is to disable Basic Auth if the Request_URI includes api calls.

What I have tried so far with the vhost of the project is following, but all this did not work.

Got the idea from the following question's accepted answer but it didn't workout for me. https://stackoverflow.com/questions/8978080/htaccess-exclude-one-url-from-basic-auth?answertab=votes#tab-top

<Directory /var/www/html/projectexample>
 AllowOverride All        
 # Auth stuff
 AuthName "Authentication Required"
 AuthType Basic
 AuthUserFile /etc/apache2/.htpasswd
 Order allow,deny
 Deny from all
 Satisfy any
 <RequireAny>
    <RequireAll>
        Require expr %{REQUEST_URI} =~ m#^/api/rest/.*#
    </RequireAll>
    Require valid-user
 </RequireAny>
</Directory>

I have also tried to use SetEnvIf environment variable like following but it didn't workout either.

<Directory /var/www/html/projectexample>
  AllowOverride All        
  # Auth stuff
  AuthName "Authentication Required"
  AuthType Basic
  AuthUserFile /etc/apache2/.htpasswd
  SetEnvIf Request_URI "^/api/*" allow=1
  #SetEnvIf Request_URI "^/(api/*)" allow=1
  Order allow,deny
  Require valid-user
  Allow from env=allow
  Deny from env!=allow
  Satisfy any
</Directory>

Any Solutions Please?

2 Answers 2

3

The Solution which worked out for me because I have SEO URLs enabled in my project:

<Directory /var/www/html/projectexample>
    AllowOverride All
</Directory>

<Location "/">
    # Default to Basic Auth protection for any stie
    AuthType Basic
    AuthName "Authentication required"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user

    # If the request goes to a rest page: bypass basic auth
    SetEnvIf Request_URI ^/api/ noauth=1

    # gets REDIRECT_ prepended if the request is a redirect
    Allow from env=REDIRECT_noauth
    Allow from env=noauth
    Order allow,deny
    Satisfy any
    Deny from env!=noauth
</Location>

Allow from env=REDIRECT_noauth is doing the trick here for SEO URLs.

2
  • 1
    I can't upvote this enough! I spent ages trying to get this to work. The only thing I was missing was the REDIRECT_noauth. Thanks. How did you come across this? It doesn't seem to be documented anywhere.
    – DazBaldwin
    Aug 28, 2019 at 15:44
  • 1
    @DazBaldwin I am glad it helped you, I found this stackoverflow.com/questions/41077895/… It helped me !
    – Haroon
    Aug 28, 2019 at 18:15
1

Assuming /var/www/html/projectexample is your document root and /var/www/html/projectexample/api is the API directory you want to allow unrestricted access, then you can just create two <Directory> containers. For example:

<Directory /var/www/html/projectexample>
  AuthName "Authentication Required"
  AuthType Basic
  AuthUserFile /etc/apache2/.htpasswd
  Require valid-user
</Directory>

<Directory /var/www/html/projectexample/api>
  Require all granted
</Directory>

The more specific /api <Directory> container overrides the former.

Assuming you are on Apache 2.4+, you should never mix old Apache 2.2 auth directives (Order allow,deny etc.) and the new <RequireAny> etc. directives. The old directives are only available for backwards compatibility only. Mixing the two types of directives can result in unexpected conflicts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .