Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My home web server is running the stock OSX Apache 2 install. I have some directories with content that I want to secure, so I setup htaccess files for those areas. However, I find it annoying to have to login to those areas as frequently as I do. Once I'm logged in I'd like to not have to login again for a long time, similar to setting a long time in a cookie. But, I'd like to increase the life time of the authenticated session with htaccess.

I've googled but haven't found what I'm looking for, maybe because I'm looking for the wrong term. I want to configure the 'session length', 'session timeout', 'time limit', or 'expiration' for users authenticated via htaccess. Any thoughts?

share|improve this question
up vote 4 down vote accepted

Sorry, but pure apache/HTTP authentication gives you no control regarding the browser. After first authentication, your server cannot instruct the browser to logout or timeout, because HTTP authentication doesn't work with session/cookies etc. and the browser will continuously send authentication credentials. To logout you should close the browser.

So, in other words, you cannot do that only from apache.


share|improve this answer
That's a shame, thanks for the info though. I'll look into using a web interface with cookies to establish a session. – brianpartridge Mar 21 '11 at 15:17

There are hacks which can allow folks to log out of htaccess style auth, but they all have one thing in common - they suck, and they'd be even harder to make work with a timeout.

I know it is easy, but try and avoid this style of auth, you will regret it in future. Perhaps look for a web app that will allow you to get at the files but use a different auth method?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.