htaccess protect all website but some paths

I need to protect all http://domain.com with AuthType Basic, but leave http://domain.com/foo/bar (http://domain.com/foo/bar is a rewrite url, not a folder)

I read about location tag but it not work in htaccess file :开发者_JS百科(.

RewriteCond %{REQUEST_URI} !^(foo/bar)
-- protect howsoever you want --

I found the answer:

SetEnvIfNoCase REQUEST_URI "/foo/bar" ExcludePath

AuthName "SiteName Administration"
AuthUserFile /.htpasswd
AuthType basic
Require valid-user

Order deny,allow
Deny from all
Allow from env=ExcludePath
Satisfy Any