In case you don't know: Basic Auth and Shopware doesn't play well together (read not at all)
So, how do you close down Shopware testing instances? Only allowing certain IPs would be great, but is not suitable all the time, so happy for every idea you have!
You can enable the maintenance mode for a sales channel and then whitelist IPs to allow access to the storefront.
It is possible to secure the storefront with basic auth but for the administration you'll have to exclude the api paths, which shouldn't be a problem as they require authentication anyways.
Apache:
AuthType Basic
AuthName 'Authentication required'
AuthUserFile /www/htdocs/shopware/.htpasswd
# Allow access to excluded path
SetEnvIf Request_URI /api noauth=1
Require env noauth
Require env REDIRECT_noauth
Require valid-user
Nginx:
server {
location ~ .php$ {
set $auth “Restricted”;
if (request\_uri ~ /api/.\*){
set $auth “off”;
}
auth_basic $auth;
auth_basic_user_file /www/htdocs/shopware/.htpasswd;
}
}