I have an apache site protected by HTTP basic authentication. The authentication is working fine. Now I would like to bypass authentication for users that are coming from a particular website by relying on the HTTP Referer header.

Here is the configuration:

    SetEnvIf Referer "^http://.*.example\.org" coming_from_example_org
    <Directory /var/www/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Deny from all
            Allow from env=coming_from_example_org
            AuthName "login required"
            AuthUserFile /opt/http_basic_usernames_and_passwords
            AuthType Basic
            Require valid-user
            Satisfy Any
    </Directory>

This is working fine for HTTP, but failing for HTTPS. My understanding is that in order to inspect the HTTP headers, the SSL handshake must be completed, but apache wants to inspect the <Directory> directives before doing the SSL handshake, even if I place them at the bottom of the configuration file.

Q: How could I workaround this issue?

PS: I'm not obsessed with the HTTP referer header, I could use other options that would allow users from a known website to bypass authantication.