Topic: Apache 2 Username/Password Protected Directories

[bcyork]

Hi, I have been trying to get password protected directories working on my Linode server. It works / behaves in a desktop browser somewhat but not like I am used to with hostmonster. Also for some reason my phone (windows phone just loads the page in the protected directory without prompting for a password. So I imagine there is some security thing I am missing that none of the info I have found searching talks about. Here is what I have done. I have created a password file and set the permissions correctly on that and it works on the desktop. However when I close the browser or open a private browsing session I am never prompted for a password again. It just feels insecure. Plus my windows phone just loads the page with no prompt. With hostmonster if I closed the browser window it would ask me for the username and password again. I also tested hostmonster directory passwords on my phone and it prompts for a username/password.

Here is what I have added to the apache2.conf file. The rest is pretty much default. There is no .htaccess file for that directory.


<Directory "/var/www/protected">
AllowOverride All
AuthType basic
AuthName "Enter Login"
AuthUserFile /etc/htpasswd/.htpasswd
Require valid-user
Order deny,allow
Allow from user1
</Directory>

It may be worth noting that I have two virtual sites / domain names running on this server at the moment however the one that is being used for this is the primary domain name.

OS: Debian 7.3
Apache 2.2.22

Thanks!

[James Blond]

Please try

<code>
<Directory "/var/www/protected">
AllowOverride none
AuthType basic
AuthName "Enter Login"
AuthUserFile /etc/htpasswd/.htpasswd
Require valid-user
</Directory>

</code>

[bcyork]

Still does the same. Loads without asking for a password on Windows Phone and doesn't ask for a password since I entered a few days ago in Chrome and IE.

Also apache service was restarted after editing config file.

[puertoblack2003]

I've been having the same issue since upgrading to 2.4 now.It works if it go to http://mywebsite.com/myfolder, the pop up box appears, but if i go to http://mywebsite.com/myfolder/index.php the box wont pop up to enter username and password

searching the web has no results...

[Jan-E]

[James Blond]

[Jan-E]

The reason I asked to reboot is because http-authentication has some quirks. In some browsers you can force a logout, in some not.

http://code.google.com/p/chromium/issues/detail?id=5497
https://bugzilla.mozilla.org/show_bug.cgi?id=287957

Rebooting might be a way to clear the authentication cache.

Edit: just tested http-authentication in IE11 on Win7. Only completely closing the browser clears the authentication. If a windows phone keeps an instance of the browser open at all times, rebooting is the only way to be sure that the browser closes for a moment.