title: Do HTTP authentication over HTTPS with URL rewriting
body: <p>I am trying to protect the <code>~/public_html/dev</code> directory using http auth basic, but to make that secure I want to run it over ssl.</p>
  
  <p>The middle section of the below <code>.htaccess</code> file switches to https if the request URI begins with <code>/dev</code> and works. </p>
  
  <p>The last section of the file works as well but does not work properly with the https redirect.</p>
  
  <p>I basically want to be able to type <code>http://www.example.com/dev/some_sub_dir/</code> and be redirected to <code>https://www.example.com/dev/some_sub_dir/</code> and prompted for the http auth username and password.</p>
  
  <p>What currently happens is if I go to <code>http://www.example.com/dev/some_sub_dir/</code> I get prompted for a username and password over port 80, and then immediately get prompted again over port 443. So my credentials are being sent twice, once in the clear, and once encrypted. Making the whole https url rewrite a little pointless.</p>
  
  <p>The reason for doing this is so that I won't be able to accidentally submit my user/pass over http; https will always be used to access the <code>/dev</code> directory.</p>
  
  <p>The <code>.htaccess</code> is in the <code>~/public_html/dev</code> directory.</p>
  
  <pre># Rewrite Rules for example.com
  RewriteEngine On
  RewriteBase /
  
  # force /dev over https
  RewriteCond %{HTTPS} !on
  RewriteCond %{REQUEST_URI} ^/dev
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
  
  # do auth
  AuthType Basic
  AuthName "dev"
  AuthUserFile /home/matt/public_html/dev/.htpasswd
  Require valid-user</pre>