I set up a .htaccess-file to protect a folder which is in the webroot. Let's call the folder /protected.
I placed the .htaccess and the .htusers file in this very folder (/protected). When I try to login into the folder using the correct login credentials I still get 403.
Here is the .htaccess file:
AuthType Basic
AuthName "Service-Bereich"
AuthBasicProvider file
AuthUserFile [FULL_PATH]/.htusers
Require valid-user
.htusers
mary:$afr1$oqJDM12K$iT9QWY4ETerG0LUtRzw8C.
(For security reasons: user data is not real! It is a mockup)
Thank you in advance.
I finally managed to get it working. I left out the AuthBasicProvider file directive and put a file into the directory. However, I would still be interested in getting it to work without placing a file into the directory. :)
Thank you for all who tried to help me solving the issue.
Related
I've never come across this error before and a search on Google doesn't turn up much. I'm getting 500 Internal Server Error. Running Ubuntu 18.04.
Apache log:
AuthType takes one argument, an HTTP authorization
type (e.g., "Basic")
.htaccess
AuthType Basic
AuthName "Restricted Content"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
/etc/apache2/.htpasswd
test:$apr1$iAZiDJQI$kx5QMVpowee3IG7eCf24X1
I've tried moving .htpasswd to the document root, changing permissions, setting owner to www-data, nothing works. AuthUserFile path is definitely correct.
A bit late, but I was having the same error with my .htaccess file, and this post turned up as the first result in Google.
The problem causing this error is your .htaccess file which is not using unix newlines.
The fix is easy, in e.g. Notepad++ open your .htaccess file, then from the menu:
Edit > EOL Conversion > Unix (LF)
Save the file and upload it and it will work, at least in my case it did.
I have 2 domains mapped to the same server.
- Domain-A is mapped to public_html directory
- Domain-B is mapped to public_html/domainb directory
When I set a .htaccess user/password for directories that I access via the first domain (e.g. domain-a.com/wp-admin) everything works like a charm.
But when I try to set the same for directories that I access from the domain-b, I got a ERR_TOO_MANY_REDIRECTS error.
Below .htaccess code. Note that the very same code works on folders of the domain-a but not on domain-b:
AuthType Basic
AuthName "myuseradmin"
AuthUserFile "/home3/desempac/.htpasswds/public_html/domainb/wp-admin/passwd"
require valid-user
Any thoughts?
change the following line in your code accordingly :
AuthUserFile /path/to/password/file/.htpasswd
Make sure you located the .htpasswd file inside the folder that you want to protect it
I've placed this code in the .htaccess file of the folder I want to protect:
AuthName "restricted area"
AuthType Basic
AuthUserFile /home/#/#/#/#/#/.htpasswd
require valid-user
In the same folder, I placed this .htpasswd:
my:pass
When I go to the URL of the protected folder, the browser keeps asking me for a password over and over, even though I'm typing the correct one.
I know that the root directory mentioned in AuthUserFile is ok because I've found it out with:
<?php
$dir = dirname(__FILE__);
echo "<p>Full path to a .htpasswd file in this dir: " .
$dir . "/.htpasswd" . "</p>";
?>
Where's the problem?
Just add "user" in between require valid-user
For example:
Require user markpanado
But not:
Require markpanado
the problem, so i found for my website, is that the htpasswd file path is not the same as the path provided in the htaccess. I spent weeks trying to find where the problem was, but although you create usernames and passes using the htpasswrd the file is not communicating with the secure folder. You will need to find out why. maybe a spelling mistake or as in my case, the htpasswd was being saved in a completely different folder, and i had 2 htpasswrd in different folders. the two need to communicate htacccess and htpasswrd, hope this saves you time I figured it out after weeks of sleepless nights.
I have just come across this problem. After trying to figure it out for the last couple of days I have found out the source of the problem:
This prompt gets triggered when using AuthType Basic and whenever a 401 message is sent from the website.
Is it possible that you had a 401 HTTP status code message being sent from the server at each request? You can check your developer console to find out.
in my htaccess I have below code which is used to save admin* area.
If I give wrong username password it keeps poping up for correct usrename but if I press cancel I can see my restriced area instead loading error page, what is wrong? thanks
AuthName "Restricted Area"
AuthType Basic
AuthUserFile /home/mydirectory/.htpasswds/.htpasswd
AuthGroupFile /dev/null
<Files admin*>
require valid-user
</Files>
Your .htaccess doesn't protect for anything else than admin*.
If you have auto index option enabled for example, it doesn't match the pattern (but having DirectoryIndex set to adminindex for example do so).
Maybe the authentication prompt is related to a resource needed by the page (JS, css, image, favicon) and not the page itself.
Could you try to inspect HTTP response using curl or apache logs ?
This might give you a hint.
curl -vso/dev/null http://localhost/test/
I had this same issue. For me the problem was a RewriteRule in the htaccess folder in a directory above the one that was password protected.
I resolved my issue by adding RewriteEngine off to the top of the htaccess in the folder I was password protecting.
I found that this behavior occurred when .htaccess was present in the parent directory but not in the actual directory being accessed. Placing another .htaccess file in the directory being accessed stopped this behavior.
If you're using wordpress, it's a known issue. Solution here
I have a website admin area I want to protect with a password..
so inside the admin folder I put an .htaccess and .htpasswd files containing this:
.htaccess:
AuthUserFile C:/wamp/www/website_project/admin/.htpasswd
AuthName "Restricted Area"
AuthType Basic
Require valid-user
.htpasswd: (generated using an online tool)
admin:sOSDxAdJI4xx2
When I go to the admin folder, a popup is shown where I need to insert username and password... so until now its working fine, BUT no matter if I insert a correct password or not I get the same popup again when I hit 'enter', I can never access the folder...
Any suggestions?
Based on the AuthUserFile line, it looks like you're using Apache on Windows, which has a different default password encryption algorithm than other platforms. Try using the htpasswd command-line tool to generate the password and see if you still have the same problem.