Apache <RequireAny> only when HTTPS

Question

I'd like to use Basic Auth only when HTTPS is used. Having a .htaccess like this the user must enter password twice

RewriteEngine On RewriteOptions Inherit # Rewrite to HTTPS (except for let's encrypt) RewriteCond %{HTTPS} off RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/.*$ RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] <RequireAny> AuthType Basic AuthName "Top Secret" AuthUserFile /is/htdocs/***/.htpasswd Require valid-user </RequireAny> 

Using this file:

• http://mysite.domain is called
• Authentication for 'http://mysite.domain' is requested (NoSSL)
• Redirect to https://mysite.domain is done
• Authentication for 'https://mysite.domain' is requested (SSL)

How can I avoid the authentication for 'http://mysite.domain' here?

Answer 1

Found it, using REQUEST_SCHEME.

<If "%{REQUEST_SCHEME} == 'https'"> <RequireAny> AuthType Basic AuthName "Top Secret" AuthUserFile /is/htdocs/***/.htpasswd Require valid-user </RequireAny> </If>