ExpressionEngine htaccess with password protected subdomain

Question

I have inherited an ExpressionEngine site and need to add a password-protected subdomain. The original htaccess file in the root directory was...

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Removes index.php from ExpressionEngine URLs
    RewriteCond %{THE_REQUEST} ^GET.*index\.php [NC]
    RewriteCond %{REQUEST_URI} !/system/.* [NC]
    RewriteRule (.*?)index\.php/*(.*) /$1$2 [R=301,NE,L]

    # Directs all EE web requests through the site index file
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d        
    RewriteRule ^(.*)$ /index.php?/$1 [L]
</IfModule>

...but when password protection was added to the subdomain, users could click "cancel" and then the page contents would become visible.

I added...

RewriteCond %{HTTP_HOST} !^mysubdomain\. [NC]

...to the second rewrite rule, and that allowed the password protection to work normally for the subdomain homepage; however, none of the pages or subdirectories in that subdomain work now. It looks like all the page resources are getting URLs like: "http://mysubdomain.domain.com/{site_url}images/uploads/core-images/image.png"

How can I get the password protection working properly without breaking the URLs so that the rest of the subdomain pages and subdirectories will work properly?

Answer 1

After much searching, we abandoned the htaccess route and went with EE's template access restrictions: https://devot-ee.com/articles/item/using-ee-built-in-http-authentication-for-restricting-development-access.