3 ms·
Right, I know it's possible (and thanks for the example) - I still whish it was easier to specify "only authorized given conditions x, y, z". In the above, a
by e12e 5y ago
Right, I know it's possible (and thanks for the example) - I still whish it was easier to specify "only authorized given conditions x, y, z".
In the above, access is implied, then revoked without a valid username/password, then login is excepted for certain conditions (IPs in this case) - and access is implied (again).
IMNHO one of the strengths of apache is how authentication providers and authorization is separated and allow for easy(ish) combinations.
That said, there's something to be said for doubling down on a single type of handling for access and rewrites (matchers).
I still prefer matchers (which resource) combined with action/policy (allow/deny/rewrite).
- francislavoie 5y agoYou could also do that, by structuring it like this: @first <whatever matcher> handle @first { do_something } @second <whatever matcher> handle @second { do_something_else } handle { error "Unauthorized" 403 } Which is basically an if/else-if/else structure. I'm not totally sure I follow how you'd like for it to be structured. Could you give a config example? I think one of the issues is `basicauth` needs to write a response header to work correctly (i.e. WWW-Authenticate to tell the browser to prompt) so it can't only act as a matcher.