HTTP Basic auth on specific Drupal paths?

Question

I want to use HTTP Basic authentication on a group of paths in my Drupal site (e.g. /folder/*). The paths are all menu callbacks that don't have actual page content.

I tried to use Secure Site but I don't see a way to specify the restricted pages. It seems to just assume that /admin is the only restricted path you would want, unless you wanted to force authentication on your whole site.

How would I go about forcing HTTP Basic auth on particular paths that don't have nodes aliased to them and that aren't admin pages?

Answer 1

I think you are looking for Sharing authentication with HTTP-Auth which describes using the Drupal user tables to supports Apaches http auth system. You will probably have to hard-code the paths in your menu, or within your page content. Then set up Apache to use http auth on the particular directories.

EDIT:

To use this technique in the Drupal environment, you would define http auth for individual directories in the apache Auth.conf file like:

<Directory /usr/local/webroot/d7.example.com/folder>
...Auth directives ...
</Directory>

where /usr/local/webroot/d7.example.com is your drupal root. This allows you to protect individual directories, while maintaining drupal authentication for your site.

Answer 2

In order to do this, I ended up hacking the Securesite module to add an option for forcing auth only on user-specified paths. I used drupal_match_path() and basically just cut and pasted this code from Cache Exclude to do the path matching:

$pages = trim(variable_get('cacheexclude_list', ''));

// If the current page is one we want to exclude from the cache,
// set the page caching to false temporarily.
if (strlen($pages) && (drupal_match_path($_GET['q'], $pages) ||
                     drupal_match_path(drupal_get_path_alias($_GET['q']), $pages) )) {
  drupal_page_is_cacheable(FALSE);
  return;

Adapting that and inserting it into securesite.inc, specifically into the _securesite_forced() function allowed me to specify my own paths. I plan to submit a feature request with patch to the project on d.o.