Apache .htaccess directives are pretty straight forward. The “SetEnvIf” that passes different values if the conditions are met then are processed by the standard Deny/Allow directive. Here’s a sample from Apache’s documentation:
#allow a single uri through .htaccess password protection SetEnvIf Request_URI "/test_uri$" test_uri #allows everything if its on a certain host SetEnvIf HOST "^test.yoursite.com" test_subdomain_url SetEnvIf HOST "^yoursite.com" live_url Order Deny,Allow AuthName "Restricted Area" AuthType Basic AuthUserFile /path/to/your/.htpasswd AuthGroupFile / Require valid-user #Allow valid-user Deny from all Allow from env=test_uri Allow from env=test_subdomain_url Allow from env=live_url Satisfy any
This is handy in case you want to control all password protected areas of your site all in one place. I have even added an admin interface that can add new environments to the web root’s .htaccess file on the fly. This is a simple way to improve your web security for different sections and works great!