Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using apache's basic http authentication to control access, however, I only want to control one level of directory access, meaning, I only want directory a to be authenticated, but not a's children(eg. a/b), is this possible?

<Location /a/>
Options -Indexes
Order Deny,Allow
Allow from all

AuthType Basic
AuthName "Members Only"
AuthUserFile /home/xxxx/.htpasswd
require valid-user

</Location>
share|improve this question

migrated from stackoverflow.com Nov 20 '11 at 1:11

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers

up vote 2 down vote accepted

AFAIK this is not possible. I have just tried it in both httpd.conf and a .htaccess file, and it doesn't work.

This is because in general, this setup makes no sense - the point of requiring auth for a directory is to protect an area of your site, and subdirectories of the protected directory would be considered part of that protected area.

The scope of HTTP Basic auth is per-domain - if you require auth for a subdirectory, those same credentials will be sent in a subsequent request to a higher level directory. This means they will also be sent in all requests for a lower level directory.

It would be possible to implement this using some custom logic in your server-side scripting (e.g. PHP) but a better solution would be to re-think your directory structure. There should be no reason to require authentication for a higher level directory, but not lower level ones - you need to move the content in your lower-level directories to an open access area of the site, and the password protected area should only contain content that should be private.

As a side note - HTTP Basic authentication over HTTP is so insecure it is almost pointless to use it at all - if you have some content you really care about protecting, consider using Digest auth. You can use HTTPS to prevent disclosure of Basic authentication credentials, and if you're using HTTPS you could also use client certificate authentication for the best available security.

share|improve this answer
    
Just a guess but not even by moving the unauthenticated directories elsewhere and referencing them via mod_rewrite? –  symcbean Sep 6 '11 at 14:51
    
No, I'm afraid not. What exactly are you trying to do/why do you need to do this? As I say, it's not really something you should ever do/need to do, and there is probably a better way... –  DaveRandom Sep 6 '11 at 15:05
add comment

Note that I have not tried this, and I am not an apache guru, but assuming DaveRandom is right, my next attempt would be to use a .htaccess file in directory /A/, then use URL rewriting to point things to /A/child, with the logic that /A/child would never cause a directory traversal to /A/ to read the .htaccess file, since the directory interpretation occurs later in the process.

Of course, if that works, it's probably a bug and will be fixed.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.