title: How do I combine basic authentication and https?
body: <p>I have setup a private website that needs to be accessible by only a few people via the internet. I'd like to setup a combination of basic authentication and https.</p>
  
  <p>So far I have everything works ok if I directly type in <code>https://blah.com/location1</code>. However <strong>what I need</strong> is to have apache redirect <code>http://blah.com/location1</code> to <code>https://blah.com/location1</code> and THEN do basic authentication i.e I don't want basic authentication to be done before the redirection. At the moment this is what I have on my apache config. </p>
  
  <pre><code>WSGIScriptAlias /site /path/to/site/apache/site.wsgi
  
  &lt;Directory /path/to/site/apache&gt;
      WSGIApplicationGroup %{GLOBAL}
      Order deny,allow
      Allow from all
  &lt;/Directory&gt;
  
  &lt;Location /site&gt;
      RewriteEngine On
      RewriteCond %{HTTPS} off
      RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
  
      AuthType Basic
      AuthName "Site login"
      AuthUserFile /path/to/site/.htpasswd
      Require valid-user
  &lt;/Location&gt;
  </code></pre>
  
  <p><strong>Note:</strong> I only need the authentication for <code>/site</code>. So I should be able to access <code>http://blah.com/site1</code>, <code>http://blah.com/site2</code> without needing authentication.</p>