Exclude rewrite directory form protectrion

Question

We have a magento installation. Because of dev purposes we have it closed with .htacces protection. But I do want to open the API so I don't have to whitelist a bunch of 3rd party services.

The construction below does work for files that exist (api.php) but not for urls that are rewriten (api, api/?wsdl).

This .htaccess is one dir above the public_html. Based on perishablepress

AuthType Basic
AuthName "Toegang nodig? neem gerust contact op: 038-8200270 !"
AuthUserFile /home/kijken/domains/.htpasswd
AuthGroupFile /dev/null
Require valid-user
# allow public access to the following resources
SetEnvIf Request_URI "^/api.php" allow
SetEnvIf Request_URI "^/api/" allow  #api is not a real folder
SetEnvIf Request_URI "^/api/?wsdl" allow

Order allow,deny
Allow from env=allow

Allow from 217.121.158.248 #Company HQ

Satisfy any

Magento with it's .htaccess is in the public_html, mirror of the file

What do I need to change to make it work with non existing files?
I don't mind a different setup as long as the following 3 criteria are met:

1. Whitelist IP (currently works)
2. Login for other IP's (currently works)
3. Exclude certain URL's (the root problem)

Answer 1

Looking at your setup and following your explanation, the easiest way of doing it would be to put your restriction code at the top of Magento htaccess (/public_html/.htaccess).

I've pasted it above the rest of the magento .htacces inside the public_html. Nothing changes about my question. The problems stay the same.

That's because Magento's htaccess erases your restriction. You need to delete those 2 lines :

Another detail
SetEnvIf Request_URI "^/api/?wsdl" allow is useless since :

1. query string part (wsdl here) is not included in Request_URI (won't match what you expect)
2. previous rule (SetEnvIf Request_URI "^/api/" allow) is larger and includes your useless one

Conclusion
Here's how your final code should look like

SetEnvIf Request_URI "^/api\.php$" allow
SetEnvIf Request_URI "^/api/" allow

AuthType Basic
AuthName "Toegang nodig? neem gerust contact op: 038-8200270 !"
AuthUserFile /home/kijken/domains/.htpasswd
AuthGroupFile /dev/null
Require valid-user
Order allow,deny
Allow from env=allow
Allow from 217.121.158.248
Satisfy any

# Magento htaccess code here

Tested and working