title: Apache Basic Auth not working in .htaccess or Directory blocks; works fine in Location blocks
body: <p>OK, running Apache 2.4.7 on Ubuntu 14.04, freshly installed.</p>
  
  <p>If I add the following to the .conf file in <code>/etc/apache2/sites-available</code>, then basic auth works fine:</p>
  
  <pre><code>&lt;Location /test&gt;
    AuthType Basic
    AuthName ".htaccess Basic Auth Test"
    AuthUserFile "/var/www/passwords/test"
    Require valid-user
  &lt;/Location&gt;
  </code></pre>
  
  <p><strong>However</strong>, if I just have the following in a <code>.htaccess</code> file in the relevant directory:</p>
  
  <pre><code>AuthType Basic
  AuthName ".htaccess Basic Auth Test"
  AuthUserFile "/var/www/passwords/test"
  Require valid-user
  </code></pre>
  
  <p>The auth seems to be ignored; no prompt, and pages served as if they're not there. Same happens with a Directory block:</p>
  
  <pre><code>&lt;Directory /var/www/default/test&gt;
    AuthType Basic
    AuthName ".htaccess Basic Auth Test"
    AuthUserFile "/var/www/passwords/test"
    Require valid-user
  &lt;/Directory&gt;
  </code></pre>
  
  <p>So, I checked if the <code>.htaccess</code> files were actually being read, and they are; adding</p>
  
  <pre><code>Options -Indexes
  </code></pre>
  
  <p>to the <code>.htaccess</code> file does remove the index listing on the directory.</p>
  
  <p>I turned on debugging but that wasn't particularly useful:</p>
  
  <pre><code>[Tue Apr 21 13:04:14.082275 2015] [authz_core:debug] [pid 8914] mod_authz_core.c(721): [client 144.32.48.10:64109] AH01625: authorization result of &lt;RequireAny&gt;: granted (directive limited to other methods)
  [Tue Apr 21 13:04:14.082538 2015] [authz_core:debug] [pid 8914] mod_authz_core.c(721): [client 144.32.48.10:64109] AH01625: authorization result of &lt;RequireAny&gt;: granted (directive limited to other methods)
  </code></pre>
  
  <p>Grep'ing in <code>/etc/apache2</code> shows nothing that would restrict this; no other <code>Auth</code> statements, <code>AllowOverride All</code> in the right places (as shown by the Options test; and they say <code>All</code>, not anything else that might restrict the overrides).</p>
  
  <p>I feel like I must be missing something obvious. Here's the modules loaded:</p>
  
  <pre><code>root@linode:/etc/apache2# apachectl -M
  Loaded Modules:
   core_module (static)
   so_module (static)
   watchdog_module (static)
   http_module (static)
   log_config_module (static)
   logio_module (static)
   version_module (static)
   unixd_module (static)
   alias_module (shared)
   auth_basic_module (shared)
   authn_core_module (shared)
   authn_file_module (shared)
   authz_core_module (shared)
   authz_host_module (shared)
   authz_user_module (shared)
   autoindex_module (shared)
   deflate_module (shared)
   dir_module (shared)
   env_module (shared)
   filter_module (shared)
   headers_module (shared)
   mime_module (shared)
   mpm_prefork_module (shared)
   negotiation_module (shared)
   php5_module (shared)
   proxy_module (shared)
   proxy_http_module (shared)
   rewrite_module (shared)
   setenvif_module (shared)
   status_module (shared)
   substitute_module (shared)
   xml2enc_module (shared)
  </code></pre>