Disable basic auth for internal IPs?

[Whitestrake (Matthew Fay)]

Hi Stefan,

Have a look at this post for an idea on how to achieve this using a “secure” external subdomain and an “insecure” internal subdomain:

Require authentication based on request IP?

Spitballing here, but what about using: Two subdomains redir 302’s with if statements based on the {remote} placeholder Shuffle 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16 to the correct vhost Blanket basicauth on the “external” subdomain Messy, but should work. Use {>X-Remote-IP} instead if you’ve got Caddy behind another proxy. Replace the private IPs with whatever you want to discriminate by, just make sure you know your if_op setting.

And here for an example of the kind of redirection you’d want to use, just change the if statements:

Basic auth my method?

Theoretically you could use a subdomain (secure.example.com) with an identical reverse proxy. Put a blanket basic auth on this subdomain. Then declare a redirect on the main domain for secure methods like so: redir 302 { if {method} is "PUT" if {method} is "DELETE" if_op or / https://secure.example.com{uri} }