Home / server / Questions

Questions[htpasswd](server)

Martin Hope
Brad
Asked: 2011-06-22 13:54:17 +0800 CST
  • 3

I am trying to configure basic auth for my index file, and only my index file. I have configured it like so:

<Files index.htm>
    Order allow,deny
    Allow from all
    AuthType Basic
    AuthName "Some Auth"
    AuthUserFile "C:/path/to/my/.htpasswd"
    Require valid-user
</Files>

When I visit the page, 401 Authorization Required is returned as expected, but the browser doesn't prompt for the username/password. Some further inspection has revealed that Apache is not sending the WWW-Authenticate header.

GET http://myhost/ HTTP/1.1
Host: myhost
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.100 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3


HTTP/1.1 401 Authorization Required
Date: Tue, 21 Jun 2011 21:36:48 GMT
Server: Apache/2.2.16 (Win32)
Content-Length: 401
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>401 Authorization Required</title>
</head><body>
<h1>Authorization Required</h1>
<p>This server could not verify that you
are authorized to access the document
requested.  Either you supplied the wrong
credentials (e.g., bad password), or your
browser doesn't understand how to supply
the credentials required.</p>
</body></html>

Why is Apache doing this? How can I configure it to send that header appropriately?

It is worth noting that this exact same set of directives work fine if I set them for a whole directory. It is only when I configure them to a directory index that they do not work. This is how I know my .htpasswd and such are fine.

I am using Apache 2.2 on Windows.

On another note, I found this listed as a bug in Apache 1.3. This leads me to believe that this is actually a configuration problem on my end.

apache-2.2 .htaccess http-basic-authentication htpasswd
Martin Hope
Dmitry
Asked: 2011-05-21 06:34:44 +0800 CST
  • 7

How do I implement the protection of the pages (asp.net mvc app), so when I hit the home page or any other pages within the application I get a login dialog popup in the browser

I'm looking for something similar to what Apache .htaccess and .htpasswd is doing.

I have IIS 7.5/Windows Server 2008 R2 Web edition.

authentication iis .htaccess http-basic-authentication htpasswd
Martin Hope
Samuel Lampa
Asked: 2011-04-14 21:21:40 +0800 CST
  • 36

For apache, there is the htpasswd utility, which can be used to generate encrypted passwords for .htaccess access restriction etc. In Ubuntu I can install it via the apache2-utils package, but in Scientific Linux (Red Hat) I find only the following package, when I do yum search htpasswd:

perl-Apache-Htpasswd.noarch : Manage Unix crypt-style password file

but this does not seem to be the package I'm looking for, since it does not include the htpasswd command, and also when I do apt-cache search htpasswd in Ubuntu, I get:

libapache-htpasswd-perl - Manage Unix crypt-style password file
lighttpd - A fast webserver with minimal memory footprint
nanoweb - HTTP server written in PHP
apache2-utils - utility programs for webservers

... where the first one is quite obviously the one corresponding to the one I found for Red Hat above(?).

So, is there any equivalent to the apache2-utils package, or any other package including the htpassd utility, for Red Hat/Scientific Linux? At least I can't find it ...

apache-2.2 htpasswd
Martin Hope
dimvic
Asked: 2010-10-22 10:40:32 +0800 CST
  • 7

I have used code like this in apache configuration to protect locations with password

<Location ~ "/admin.*">
    AuthType Basic
    AuthName "Protected Area"
    AuthUserFile /home/user/public_html/.htpasswd
    Require valid-user
</Location>

is there a way to do the same thing using an htaccess file?

the locations I want to protect don't really exist on the filesystem, it's locations available thanks to mod_rewrite

apache-2.2 authentication .htaccess htpasswd