.htaccess: combine IP block and basic auth

Question

What I want to achieve:

• one .htaccess file for production and staging
• basic auth protection for staging environment (based on hostname)
• block specific IP on both enviroments

What I tried so far:

SetEnvIfNoCase Host development\.foobar\.tld authRequired

<RequireAny>
  <RequireAll>
    Require all granted
    Require not ip 1.2.3.4
  </RequireAll>
  <RequireAny>
    <RequireAll>
      Require all granted
      Require not env authRequired
    </RequireAll>
    AuthType Basic
    AuthName "Development"
    AuthUserFile /path/to/.htpasswd
    Require valid-user
  </RequireAny>
</RequireAny>

My problem now is that the IP block is ignored. I've no idea how to properly nest the Require directives.

Answer 1

I have similar setup, but I'm not using password based authentication for it. However, I think that this approach should work for you too.

What you need to do is to store the result of the IP check in a variable for later use.
The code below is untested but I think it will work:

SetEnvIf X-Forwarded-For "^1\.2\.3\.4" reject-access

<If "%{HTTP_HOST} =~ /development\.foobar\.tld$/">
    AuthType Basic
    AuthName "Development"
    AuthUserFile /path/to/.htpasswd
    <RequireAll>
        Require not env reject-access
        Require valid-user
    </RequireAll>
</If>
<Else>
    <RequireAll>
        Require not env reject-access
    </RequireAll>
</Else>