Say we want to specifically protect the "private" directory. We simply subclass the HTTPConnection class, and replace the "isPasswordProtected" and "passwordForUser" methods as follows:
- (BOOL)isPasswordProtected:(NSString *)path
- (NSString *)passwordForUser:(NSString *)username
Then we simply instruct the HTTPServer to use our subclassed connection class:
[httpServer setConnectionClass:[MyHTTPConnection class]];
And that's all there is to it. Now you can browse your Sites directory as normal, except your ~/Sites/private directory will be password protected.
Download it here.
There's a lot more that can be done with the server, such as serving up custom dynamic content, TLS encryption, etc.