How to restrict access to a child SVN directory only?

Question

I'm trying to configure permissions for an SVN repository accessed through Apache 2. What I want is to let anyone access the root directory, while restricting to authenticated users a child directory. Example:

/demo
/demo/project1
/demo/project1/sensitive-data  # This path should require user authentication.
/demo/project2

At first, I thought this was as simple as:

<Location /demo>
    DAV svn
    SVNPath /home/svn/demo
    AuthType Basic
    AuthName demo
    AuthUserFile /etc/subversion/passwd
    <LimitExcept GET PROPFIND OPTIONS REPORT>
        Require valid-user
    </LimitExcept>
</Location>

<Location /demo/project1/sensitive-data>
    DAV svn
    Require valid-user
</Location>

When used through HTTP (for example with CURL), Apache conforms to the configuration: I can access:

• http://example.com/demo/,
• http://example.com/demo/project1/ and:
• http://example.com/demo/project2/,

and I get, as expected, a HTTP 401 Unauthorized when trying to retrieve http://example.com/demo/project1/sensitive-data.

On the other hand, doing:

• svn checkout http://example.com/demo/ . or:
• svn checkout http://example.com/demo/project1/ .

retrieves the whole directory tree, including demo/project1/sensitive-data.

At least, svn checkout http://example.com/demo/project1/sensitive-data/ . requests for a password.

How should I configure the permissions to restrict the access to sensitive-data directory when doing svn checkout http://example.com/demo/ .?

Answer 1

The <Location /demo/project1/sensitive-data> block is irrelevant when doing a checkout: it is used only when accessing http://example.com/demo/project1/sensitive-data directly, which is the reason why HTTP requests result in HTTP 401 Unauthorized and a checkout of this particular directory requires authentication.

The proper way to configure path-based authorization is explained in Subversion documentation:

1. <Location /demo> points to an access file:

   <Location /demo>
       ...
       AuthzSVNAccessFile /etc/subversion/access.conf
       ...
   </Location>
   

2. The access file defines who can access the specific files and directories. Basic example:

   [/]
   * = r                  # Everyone should be able to access the repository.
   
   [/demo/project1/sensitive-data] # Note that there is no trailing slash.
   * =                    # Nobody should access the sensitive directory.