title: Exclude specific cakephp controller from http basic auth
body: <p>I'm trying to exclude a path (URI) from being blocked by basic http auth.
  The path is /rest (<a href="http://example.com/rest" rel="noreferrer">http://example.com/rest</a>) and represents a controller of a cakephp 3 application. It is NOT a real file, but rather a path rewritten by a rewite-condition and handeled by index.php in the webroot dir.</p>
  
  <p>Here's the rewrite rules:</p>
  
  <p><code>/var/www/.htaccess</code>:</p>
  
  <pre><code>&lt;IfModule mod_rewrite.c&gt;
       RewriteEngine on
       RewriteRule    ^$    webroot/    [L]
       RewriteRule    (.*) webroot/$1    [L]
  &lt;/IfModule&gt;
  </code></pre>
  
  <p><code>/var/www/webroot/.htaccess</code>:</p>
  
  <pre><code>&lt;IfModule mod_rewrite.c&gt;
    RewriteEngine On
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>I'm running apache 2.4 and tried different configurations:</p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
     ServerAdmin webmaster@localhost
     DocumentRoot /var/www/webroot
  &lt;Directory /var/www&gt;
     Options FollowSymLinks
     AllowOverride All
  &lt;/Directory&gt;
  &lt;Location "/"&gt;
             AuthType Basic
             AuthName "Keawe Development"
             AuthUserFile /host/.htpasswd
             Require valid-user
             Require expr %{REQUEST_URI} =~ m#/rest/.*#
             Require expr %{REQUEST_URI} =~ m#/index.php/rest/.*#
  &lt;/Location&gt;
     ErrorLog ${APACHE_LOG_DIR}/error.log
     CustomLog ${APACHE_LOG_DIR}/access.log combined
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>...adapted from <a href="https://stackoverflow.com/a/33655232/1285585">https://stackoverflow.com/a/33655232/1285585</a></p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
     ServerAdmin webmaster@localhost
     DocumentRoot /var/www/webroot
  &lt;Directory /var/www&gt;
     Options FollowSymLinks
     AllowOverride All
  &lt;/Directory&gt;
  &lt;Location "/"&gt;
             AuthType Basic
             AuthName "Keawe Development"
             AuthUserFile /host/.htpasswd
             Require valid-user
  &lt;/Location&gt;
  &lt;Location "/rest"&gt;
     Allow from all
     Satisfy any
  &lt;/Location&gt;
     ErrorLog ${APACHE_LOG_DIR}/error.log
     CustomLog ${APACHE_LOG_DIR}/access.log combined
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>... from <a href="https://serverfault.com/a/475845/229877">https://serverfault.com/a/475845/229877</a></p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/webroot
  &lt;Directory /var/www&gt;
    Options FollowSymLinks
    AllowOverride All
   &lt;/Directory&gt;
   &lt;Location "/"&gt;
     AuthType Basic
     AuthName "Keawe Development"
     AuthUserFile /host/.htpasswd
     Require valid-user
   &lt;/Location&gt;
   &lt;Location "/rest"&gt;
     Require all granted
   &lt;/Location&gt;
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined
   &lt;/Virtualhost&gt;
  </code></pre>
  
  <p>... from <a href="https://www.apachelounge.com/viewtopic.php?p=30200" rel="noreferrer">https://www.apachelounge.com/viewtopic.php?p=30200</a></p>
  
  <pre><code>...
   &lt;Location "/"&gt;
             SetEnvIf Request_URI ^/rest noauth=1
             SetEnvIf Request_URI /rest noauth=1
             SetEnvIf Request_URI ^/index.php/rest noauth=1
             SetEnvIf Request_URI /index.php/rest noauth=1
  
             AuthType Basic
             AuthName "Keawe Development"
             AuthUserFile /host/.htpasswd
             Order Deny,Allow
             Satisfy any
             Deny from all
             Require valid-user
             Allow from env=noauth
   &lt;/Location&gt;
  </code></pre>
  
  <p>... from <a href="https://stackoverflow.com/a/8979889/1285585">https://stackoverflow.com/a/8979889/1285585</a></p>
  
  <pre><code> &lt;Location "/"&gt;
     AuthType Basic
     AuthName "Keawe Development"
     AuthUserFile /host/.htpasswd
     Require valid-user
   &lt;/Location&gt;
   &lt;Location ~ "/(rest|index.php/rest)"&gt;
     Satisfy Any
     Allow from all
     AuthType None
     Require all granted
   &lt;/Location&gt;
  </code></pre>
  
  <p>... from <a href="https://stackoverflow.com/a/13296294/1285585">https://stackoverflow.com/a/13296294/1285585</a></p>
  
  <pre><code>&lt;Location "/"&gt;
    AuthType Basic
    AuthName "Keawe Development"
    AuthUserFile /host/.htpasswd
    Require valid-user
  &lt;/Location&gt; 
  &lt;Files "index.php/rest"&gt;
     Satisfy Any
     Allow from all
  &lt;/Files&gt;
  &lt;Files "rest"&gt;
     Satisfy Any
     Allow from all
  &lt;/Files&gt;
  </code></pre>
  
  <p>... from <a href="https://stackoverflow.com/questions/3865374/http-basic-auth-exclude-single-file">HTTP Basic Auth Exclude Single File</a></p>
  
  <p>However, none of them seem to work. I always get error 401 using wget or an auth request from a browser.</p>
  
  <p>The problem seems to be, that the path /rest passes the condition but then is rewritten to index.php, which is under control of basic auth (and has to be).</p>
  
  <p>Any clues?</p>