Redirect all traffic to holding page unless logged in using .htaccess

Question

I currently have a landing page setup on my domain.com which already receives traffic.

It will shortly be replaced with an online store. I need to upload this store to my live server in order to get it approved by the Merchant Facility Providers (MFP), and they require it to be accessible from it's final live location on domain.com in order to get approvals. I can't have users access this site until it has met approvals.

To accomplish this I wish to redirect all domain.com traffic to domain.com/holding/ except for MFP visitors.

Ideally this would be restricted by IP address, however MFP say they will need to grant a number of external parties access, and so IP address based access will not be acceptable and I should use passwords.

So my question is, how can I automatically redirect all traffic from domain.com to the holding page domain.com/holding/ unless they have logged in using a password at domain.com/login? Users visiting the domain.com should not be asked for a password.

Will this be possible using just .htaccess/.htpasswd? If so, can someone suggest how the logic of how it could work?

Answer 1

It's not possible using just an .htaccess file as all visitors would be presented with an HTTP standard authentication dialog if you enabled it on your domain.com site at the doc_root level.

Without knowing what scripting language you're using? (you've not indicated in the tags, just apache), but you could provide one index page that both acts as a landing page for users/potential-users as well as provide a login (username/password form) for MFP parties (wherever they may come from).

That way, you fulfil both needs without offending or discriminating in any way against any party.

Answer 2

As @nickhar has pointed out, there appears to be no way of doing this using just .htaccess. My solution was to use a rewrite rule to redirect all requests from domain.com to domain.com/holding unless a specific cookie was set (checked for using RewriteCond %{HTTP_COOKIE}). I set this cookie in a php script on domain.com/login, which was password protected using .htaccess/.htpasswd.

This is by no means a particularly secure solution, but is adequate for my purposes of keeping the site hidden from general traffic while the approval process is completed.