title: Basic Auth Required with just extension
body: <p>We have some public content on the cloud and I am trying to use Basic Auth to deter people from accessing our non-production web-site unless they are on our corporate network.</p>
  
  <p>Everything is working until I submit a request that is just an extension such as '/.js'.</p>
  
  <pre><code>$ wget https://test.domain.com/.js
  HTTP request sent, awaiting response... 401 Authorization Required
  Authorization failed.
  </code></pre>
  
  <p>If I add a file name, I am not asked for to authenticate. I get a 200 if the file actually exists.</p>
  
  <pre><code>$ wget https://test.domain.com/x.js
  HTTP request sent, awaiting response... 404 Not Found
  2014-05-29 16:59:35 ERROR 404: Not Found.
  </code></pre>
  
  <p>Here is the Basic Auth configuration. It is the .htaccess directory in the document root.</p>
  
  <pre><code>SetEnvIf     HOST             "^www.domain.com$"    allowProduction
  SetEnvIF     X-Forwarded-For  "123\.123\.123\.123"  allowEmployee
  
  AuthType     Basic
  AuthName     "Authentication Required"
  AuthUserFile /location/of/passwords/.htpasswd
  
  Order        Deny,Allow
  Deny         from all
  Satisfy      any
  Require      valid-user
  Allow        from env=allowProduction
  Allow        from env=allowEmployee
  </code></pre>
  
  <p>I modified the log format to display X-Forwarded-For since Apache sits behind a load balancer.</p>
  
  <pre><code>123.123.123.123 test.domain.com - - [29/May/2014:16:54:48 -0400] "GET /.js HTTP/1.0" 401 497 "-" "Wget/1.12 (linux-gnu)"
  123.123.123.123 test.domain.com - - [29/May/2014:16:59:35 -0400] "GET /x.js HTTP/1.0" 404 287 "-" "Wget/1.12 (linux-gnu)"
  </code></pre>
  
  <p>I even tried adding some rule based on the request URI. I tried a few variations with and without the leading '/'. None of them worked.</p>
  
  <pre><code>SetEnvIf     Request_URI      "^/\..*$"             allowJunk
  </code></pre>
  
  <p>And then added the following.</p>
  
  <pre><code>Allow        from env=allowJunk
  </code></pre>
  
  <p>We do have a rewrite rule to forbid requests that have a leading '.' but that is a 403 and not a 401. A 403 is acceptable since the browser can ignore it. A 401 requires a user to enter the user name and password.</p>
  
  <pre><code>RewriteRule "(^|/)\." - [F]
  </code></pre>
  
  <p>An example of a forbidden request.</p>
  
  <pre><code>$ wget https://test.domain.com/x/.js
  HTTP request sent, awaiting response... 403 Forbidden
  2014-05-29 17:04:18 ERROR 403: Forbidden.
  </code></pre>
  
  <p>The simple solution would be to not request any leading '.' URLs but we are using someone else's framework and we get these requests on some browser. Rewriting the framework for a small percentage of our customers is not desirable. Prompting them for a password is even less desirable.</p>
  
  <p>Any suggestions?</p>
  
  <p>Thanks,
  Wes.</p>