I want to use HTTP Basic authentication on a group of paths in my Drupal site (e.g. /folder/*). The paths are all menu callbacks that don't have actual page content.

I tried to use Secure Site but I don't see a way to specify the restricted pages. It seems to just assume that /admin is the only restricted path you would want, unless you wanted to force authentication on your whole site.

How would I go about forcing HTTP Basic auth on particular paths that don't have nodes aliased to them and that aren't admin pages?

2 Answers 2


I think you are looking for Sharing authentication with HTTP-Auth which describes using the Drupal user tables to supports Apaches http auth system. You will probably have to hard-code the paths in your menu, or within your page content. Then set up Apache to use http auth on the particular directories.


To use this technique in the Drupal environment, you would define http auth for individual directories in the apache Auth.conf file like:

<Directory /usr/local/webroot/d7.example.com/folder>
...Auth directives ...

where /usr/local/webroot/d7.example.com is your drupal root. This allows you to protect individual directories, while maintaining drupal authentication for your site.

  • How come I have never found that article on DO?!?
    – mpdonadio
    Commented Mar 12, 2013 at 23:43
  • Another avid DO searcher :-) Sometimes you have to tweak the search. Sometimes you just get lucky.
    – Triskelion
    Commented Mar 12, 2013 at 23:53
  • That basically just says to use Secure Site, though, or am I reading it wrong? This appears to be for securing non-Drupal sites.
    – beth
    Commented Mar 12, 2013 at 23:59
  • Re-read the first paragraph. The example they gave was for site-wide application, but it applies equally to individual directories (see my edit). The Auth directives would go into the general apache configuaration (I am not sure if they can be placed in .htaccess).
    – Triskelion
    Commented Mar 13, 2013 at 0:16
  • I don't think that your answer works for individual directories. Apache basic authentication protects the files that Apache is serving; in the case of Drupal, this is 'index.php' at the Drupal root. If you wanted to protect only some Drupal paths with basic auth, you'd have to make Drupal sent the 503; Apache can't be used here. Commented Mar 13, 2013 at 2:00

In order to do this, I ended up hacking the Securesite module to add an option for forcing auth only on user-specified paths. I used drupal_match_path() and basically just cut and pasted this code from Cache Exclude to do the path matching:

$pages = trim(variable_get('cacheexclude_list', ''));

// If the current page is one we want to exclude from the cache,
// set the page caching to false temporarily.
if (strlen($pages) && (drupal_match_path($_GET['q'], $pages) ||
                     drupal_match_path(drupal_get_path_alias($_GET['q']), $pages) )) {

Adapting that and inserting it into securesite.inc, specifically into the _securesite_forced() function allowed me to specify my own paths. I plan to submit a feature request with patch to the project on d.o.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.