Excluding a specific URL from HTTP Basic Auth - mod_rewrite causing problems - apache

Question

We have "HTTP Basic Auth" on a certain subdomain of ours, but would like to allow everything to access a specific URL on that subdomain without authenticating (for a 3rd party hitting our webhook URL).
So I tried to use SetEnvIf Request_URI ^/webhook/ allow to allow with Allow from env=allow (full file below) but it seems that because we've got some mod_rewrite rules to rewrite all these URLs to a PHP entry point, the Request_URI is never actually /webhook once it gets to this point (guessing but didn't know how to 100% confirm this.
It's still asking for a basic auth user/pass regardless of the URL.
Note that the .htaccess file is the same on all our domains / subdomains, whereas the VirtualHost can be configured just for this subdomain.
Full VirtualHost config with the "HTTP Basic Auth" config section:
<VirtualHost *:80>
RewriteEngine on
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=permanent,L]
DocumentRoot /var/www/sub.ourdomain.co.uk/blah/www
ServerAdmin x#ourdomain.co.uk
ServerName sub.ourdomain.co.uk
ServerAlias www.sub.ourdomain.co.uk
ErrorDocument 400 /error.php
ErrorDocument 401 /error.php
ErrorDocument 403 /403.html
ErrorDocument 404 /error.php
ErrorDocument 405 /error.php
ErrorDocument 408 /error.php
ErrorDocument 410 /error.php
ErrorDocument 411 /error.php
ErrorDocument 412 /error.php
ErrorDocument 413 /error.php
ErrorDocument 414 /error.php
ErrorDocument 415 /error.php
ErrorDocument 500 /error.php
ErrorDocument 501 /error.php
ErrorDocument 502 /error.php
ErrorDocument 503 /error.php
ErrorDocument 506 /error.php
ErrorLog /var/log/httpd/sub.ourdomain.co.uk.apache.log
CustomLog /var/log/httpd/sub.ourdomain.co.uk.access.log combined
<Directory "/var/www/sub.ourdomain.co.uk/blah/www">
SetEnvIf Request_URI ^/webhook/ allow
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/httpd/passwords/sub.ourdomain.co.uk
# Setup a deny/allow
Order Deny,Allow
# Deny from everyone
Deny from all
# except if either of these are satisfied
Satisfy any
# 1. a valid authenticated user
Require valid-user
# or 2. the "allow" var is set
Allow from env=allow
</Directory>
</VirtualHost>
.htaccess mod_rewrite rules:
RewriteCond %{REQUEST_METHOD} !(^GET|^POST|^HEAD)
RewriteRule .* - [R=405,L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} !(/img|/js|/css|/fonts)
RewriteRule ^(.*)$ /boot.php
RewriteCond %{REQUEST_URI} ^/$
RewriteRule ^(.*)$ /boot.php
Edit 1 - based on the comments I also tried: SetEnv allow true and SetEnv allow 1 to remove the doubt of whether it's the URL and it still asks for the basic auth password, so it may not be related to the URL afterall.
Edit 2 - Adding the entire .htaccess to make sure I'm not missing something else:
php_value max_input_vars 4000
RewriteEngine on
# Disallow other HTTP verbs such as PUT and DELETE
RewriteCond %{REQUEST_METHOD} !(^GET|^POST|^HEAD)
RewriteRule .* - [R=405,L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} !(/img|/js|/css|/fonts|/twig|/pdf|/vendors|/server-status)
RewriteRule ^(.*)$ /boot.php
RewriteCond %{REQUEST_URI} ^/$
RewriteRule ^(.*)$ /boot.php
AddType font/ttf .ttf
AddType font/eot .eot
AddType font/otf .otf
AddType font/woff .woff
<IfModule mod_deflate.c>
AddOutputFilterByType DEFLATE text/css text/javascript application/x-javascript application/javascript text/x-component text/html text/richtext image/svg+xml text/plain text/xsd text/xsl text/xml image/x-icon application/json font/woff font/otf font/eot font/ttf
</IfModule>
<ifModule mod_expires.c>
ExpiresActive On
ExpiresDefault "access plus 1 seconds"
ExpiresByType text/html "access plus 1 seconds"
ExpiresByType image/gif "access plus 2592000 seconds"
ExpiresByType image/jpeg "access plus 2592000 seconds"
ExpiresByType image/png "access plus 2592000 seconds"
ExpiresByType text/css "access plus 604800 seconds"
ExpiresByType font/ttf "access plus 604800 seconds"
ExpiresByType font/eot "access plus 604800 seconds"
ExpiresByType font/otf "access plus 604800 seconds"
ExpiresByType font/woff "access plus 604800 seconds"
ExpiresByType text/javascript "access plus 604800 seconds"
ExpiresByType application/x-javascript "access plus 604800 seconds"
</ifModule>
<ifModule mod_headers.c>
<filesMatch "\\.(ico|pdf|flv|jpg|jpeg|png|gif|swf)$">
Header set Cache-Control "max-age=2592000, public, proxy-revalidate"
</filesMatch>
<filesMatch "\\.(js|css|ttf|eot|otf|woff)$">
Header set Cache-Control "max-age=604800, public, proxy-revalidate"
</filesMatch>
<filesMatch "\\.(xml|txt)$">
Header set Cache-Control "max-age=216000, public, must-revalidate"
</filesMatch>
</ifModule>
Edit 3 - Sorry, should have mentioned that we're stuck on Apache 2.2 for now.

Answer 1

Using Apache 2.4+ you can use <If> expression to disable auth or use allow from all directive for a URI using THE_REQUEST variable. THE_REQUEST represents original request sent to Apache and it doesn't get updated in the context of a single request:
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/httpd/passwords/sub.ourdomain.co.uk
Require valid-user
Satisfy any
Order deny,allow
Deny from all
<If "%{THE_REQUEST} =~ /webhook/">
Satisfy any
Allow from all
</If>
# your current mod_rewrite rules can appear below this line:
DirectoryIndex boot.php
RewriteEngine on
# Disallow other HTTP verbs such as PUT and DELETE
RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)
RewriteRule ^ - [R=405,L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} !(/img|/js|/css|/fonts|/twig|/pdf|/vendors|/server-status)
RewriteRule ^ boot.php [L]
Update: Here is a workaround solution that works on Apache 2.2 using <FilesMatch> directive:
DirectoryIndex boot.php
RewriteEngine on
# Disallow other HTTP verbs such as PUT and DELETE
RewriteCond %{REQUEST_METHOD} !^(GET|POST|HEAD)
RewriteRule ^ - [R=405,L]
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_URI} !(/img|/js|/css|/fonts|/twig|/pdf|/vendors|/server-status)
RewriteRule ^ boot.php [L]
SetEnvIfNoCase Request_URI ^/webhook/ allow
<FilesMatch "^(?!boot\.php$).*$">
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/httpd/passwords/sub.ourdomain.co.uk
Require valid-user
Order Deny,Allow
Deny from all
Allow from env=allow
Satisfy any
</FilesMatch>