Hello, I'm having a little difficulty with my .htaccess when combining a password protection on a file and a mod_rewrite:

If I only have this as my .htaccess

<FilesMatch "manage.php">
AuthName "Member Only"
AuthType Basic
AuthUserFile /home/myuser/.htpasswd
require valid-user
</FilesMatch>

It password protects manage.php fine.

If I have this as my .htaccess

RewriteEngine on
RewriteCond $1 !^(index\.php|manage\.php|robots\.txt)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L,QSA]

It works as expected: robots.txt, index.php and manage.php are left alone and are called as normal, everything else is redirected to index.php/$1

HOWEVER, If I combine them then when I visit manage.php it gets redirected as index.php/$1, i.e. the FilesMatch is causing the entry in rewritecond to be ignored.

If I actually enter a password in the original test and get to the file, it works in this last test. So I guess something is up with the rewrite and the file match.

i.e. entering this causes .\manage.php to be called as .\index.php\manage.php

<FilesMatch "manage.php">
AuthName "Member Only"
AuthType Basic
AuthUserFile /home/myuser/.htpasswd
require valid-user
</FilesMatch>

RewriteEngine on
RewriteCond $1 !^(index\.php|manage\.php|robots\.txt)
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php/$1 [L,QSA]

Thanks for any help :)