Combine Apache’s HTTP authentication with X-Forwarded-For IP whitelisting in a reverse proxy Loadbalancer
If you want to protect a page or an entire website with HTTP authentication, but also want to whitelist a few fixed IPs (for instance: office or VPN IPs), you can combine both authentication mechanisms in Apache 2.4 via .htaccess
files.
The full example goes like this.
Request Deny
Require all denied
Set deny all requests as default.
Basic Auth
AuthName "Restricted Area"
AuthType Basic
AuthBasicProvider file
AuthUserFile /path/to/your/.htpasswd
Use Basic authentication.
Require valid-user
Show password prompt.
IP Whitelisting
Normal IP whitelist
# Normal whitelist would just add Allow directives
Require ip 12.34.56.7
Require ip 12.34.56.8
Behind a reverse proxy, load balancer or a CDN, the IP available in logs is the load balancer / reverse proxy IP. Not the client IP. The client IP information can be found in X-Forwarded-For field
# Allow from an IP in the X-Forwarded-For header
SetEnvIF X-Forwarded-For "12.34.56.7" AllowIP
SetEnvIF X-Forwarded-For "12.34.56.8" AllowIP
Require env AllowIP
References:
https://ma.ttias.be/apache-http-authentication-with-x-forwarded-for-ip-whitelisting-in-varnish/#ip-whitelisting-with-x-forwarded-for
https://vfac.fr/blog/block-allow-ip-with-apache-2
https://httpd.apache.org/docs/2.4/howto/access.html