密码保护特定的URL

Question

该网站位于共享主机上.我需要密码保护单个URL.

http://www.example.com/pretty/url

显然,这不是我想要保护的物理文件路径,它只是特定的URL.

有.htaccess的快速解决方案吗？

Answer 1

您应该能够使用mod_env和Satisfy any指令的组合来完成此操作.您可以使用它SetEnvIf来检查Request_URI,即使它不是物理路径.然后,您可以检查变量是否在Allow语句中设置.因此,您需要使用密码登录,或者Allow在没有密码的情况下让您进入:

# Do the regex check against the URI here, if match, set the "require_auth" var
SetEnvIf Request_URI ^/pretty/url require_auth=true

# Auth stuff
AuthUserFile /var/www/htpasswd
AuthName "Password Protected"
AuthType Basic

# Setup a deny/allow
Order Deny,Allow
# Deny from everyone
Deny from all
# except if either of these are satisfied
Satisfy any
# 1. a valid authenticated user
Require valid-user
# or 2. the "require_auth" var is NOT set
Allow from env=!require_auth

Answer 2

您可以使用<LocationMatch>或只是<Location>在您的<VirtualHost>指令中执行此操作(假设您可以访问您的httpd.conf/vhost.conf - 或者您可以在文档根目录中放置类似的.htaccess,如果您必须以这种方式配置您的站点) .

例如:

<VirtualHost *:80>
  ServerName www.example.com
  DocumentRoot /var/www/blabla
  # Other usual vhost configuration here
  <Location /pretty/url>
    AuthUserFile /path/to/.htpasswd
    AuthGroupFile /dev/null
    AuthName "Password Protected"
    AuthType Basic
    require valid-user
  </Location>
</VirtualHost>

<LocationMatch>如果要将正则表达式与漂亮的URL匹配,可能会发现更有用.文档在这里.

Answer 3

由于Rick在评论中指出这个问题没有答案,所以这里是我使用的片段:

AuthName "Protected Area"
AuthType Basic
AuthUserFile /path/to/your/.htpasswd
AuthGroupFile /dev/null

SetEnvIf Request_URI .* noauth
SetEnvIf Request_URI the_uri_you_want_to_protect !noauth
SetEnvIf Request_URI another_uri !noauth
SetEnvIf Request_URI add_as_many_as_you_want !noauth

<RequireAny>
  Require env noauth
  Require valid-user
</RequireAny>

如果你需要支持Apache 2.2和Apache 2.4(显然有两个版本并行运行的设置......):

AuthName "Protected Area"
AuthType Basic
AuthUserFile /path/to/your/.htpasswd
AuthGroupFile /dev/null

SetEnvIf Request_URI .* noauth
SetEnvIf Request_URI the_uri_you_want_to_protect !noauth
SetEnvIf Request_URI another_uri !noauth
SetEnvIf Request_URI add_as_many_as_you_want !noauth

<IfModule mod_authz_core.c>
    <RequireAny>
        Require env noauth
        Require valid-user
    </RequireAny>
</IfModule>

<IfModule !mod_authz_core.c>
    Order Deny,Allow
    Deny from all
    Satisfy any
    Require valid-user
    Allow from env=noauth
</IfModule>

Apache 2.2的代码取自Jon Lin.

Answer 4

所有提供的解决方案对我都不起作用。我认为以下指令可以解决问题：

SetEnvIf Request_URI ^/page-url auth=1

AuthName "Please login"
AuthType Basic
AuthUserFile "/www/live.example.com/files/html/.htpasswd"

# first, allow everybody
Order Allow,Deny
Satisfy any
Allow from all
Require valid-user
# then, deny only if required
Deny from env=auth