Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

First off my terminology is probably wrong but when I hear "direct access" I think someone means that anyone has read privileges to a file from the url. Is my understanding of what "direct access" means correct?

I'm using htaccess to prevent direct access to the following directory (The http directory is DocumentRoot /var/www/public_html)

<Directory /var/www/public_html/indirect_access/>
        AuthType Basic
        AuthName "Restricted Access"
        AuthUserFile /passwords/me
        Require user me
</Directory>

I have two files

/var/www/public_html/indirect_access/indirect.php

<?php echo 'hi'; ?>

/var/www/public_html/direct.php

<?php include('indirect_access/indirect.php'); ?>

When someone goes to www.mysite.com/direct.php, the browser prints 'hi'. When someone goes to www.mysite.com/indirect_access/indirect.php they are prompted for a username and password.

However when I change the contents of /var/www/public_html/direct.php to include an AJAX request like

$.ajax({
    url: "indirect_access/indirect.php",
    type: "GET",
    dataType: 'html',              
    success: function(data){      
        $("body").prepend(data);
    },
});

and then I try to access www.mysite.com/direct.php, I'm prompted for a username/pass.

Is it possible to prevent htpasswd from prompting authentication for indirect access to a file via ajax?

share|improve this question
1  
From the server's perspective, there is no difference between your 'direct' and 'indirect' request. Both are simply GET requests for a particular URL. One possible difference is the HTTP_REFERER - which you can use in your htaccess - however, it is set client side and is easy to spoof. The best approach would probably be to authenticate each request in PHP. See this question and this question for some starting points. –  cyberx86 Mar 21 '12 at 0:37
    
@cyberx86 Thanks for the advice. I authenticate each request in PHP for *.php files in /var/www/public_html/ like /var/www/public_html/home.php and /var/www/public_html/sitemap.php. I think I'm going to have to pull all files that ajax requests are done on. –  user784637 Mar 21 '12 at 0:58
    
I just realized your most-upvoted answer was asked by me lol –  user784637 Mar 21 '12 at 1:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.