Require Both a Squid Login and the Right Client IP

A correct password is only half of this policy: the account should work from one approved client address as well. In Squid, putting both checks on the same access rule is the difference between that requirement and two separate ways in.

Assuming authentication is already configured, such as a Squid 6.13 NCSA setup, the core policy is:

acl approved_login proxy_auth alex
acl approved_source src 192.0.2.40/32
http_access allow approved_source approved_login
http_access deny all

Use the source Squid actually receives; the sample is a documentation address. Retain earlier protections for unsafe destination ports, local services, and CONNECT traffic. This fragment shows the combined condition rather than a complete listener configuration.

Check the rules above it

An earlier broad allow can accept a request before it reaches the new condition. The http_access reference describes ordered matching. Read the full sequence, including included files.

One allow for the username and another for the source do not require both. Either line can succeed independently. That is a different policy.

The proxy_auth ACL depends on an authentication helper. Defining it is not how you create the user or validate the password. This example is for an explicit proxy whose clients can respond to proxy authentication challenges.

Source identity has limits too. People behind one NAT can share an address, and a moving laptop can change addresses. The extra condition narrows the account's usable network location; it does not reliably identify a physical computer. Make sure that limitation matches the reason you added the condition in the first place.