During development phase a dev site should be protected from being browsable by unauthorized visitors. Usually I use Basic Auth configured in the web server. This way the only information an unauthorized visitor gets is the domain name.
Drupal 8 uses Basic Auth or OAuth for REST (no Cookie method).
If you want to protect dev sites and use REST with Basic Auth you have a problem. Usually, you setup the webserver to use Basic Auth, as said above. But with Basic Auth module enabled Drupal triggers a 403 Access Denied because Drupal tries also to process the Basic Auth header.
- The header goes also to Drupal, that tries to use it, giving you a 403 because webserver Basic Auth doesn't match with Drupal users.
- If you use two Basic Auth headers (one for the webserver or external layer, another for Drupal when consuming the REST services) you have you tweak your REST service consumers to send those two headers. Also, your webserver or external layer should remove the right header and pass header that Drupal should use.
- (Use always OAuth for REST services) It seems that OAuth uses Authorization header too so not a solution.
- Use other method to protect the dev site than Basic Auth.
Any other way to accomplish this?
NOTE: Clients have no static IP and can't use a VPN to connect (this is mainly because customers must be able to check the dev site).