Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First off my terminology is probably wrong but when I hear "direct access" I think someone means that anyone has read privileges to a file from the url. Is my understanding of what "direct access" means correct?

I'm using htaccess to prevent direct access to the following directory (The http directory is DocumentRoot /var/www/public_html)

<Directory /var/www/public_html/indirect_access/>
        AuthType Basic
        AuthName "Restricted Access"
        AuthUserFile /passwords/me
        Require user me

I have two files


<?php echo 'hi'; ?>


<?php include('indirect_access/indirect.php'); ?>

When someone goes to, the browser prints 'hi'. When someone goes to they are prompted for a username and password.

However when I change the contents of /var/www/public_html/direct.php to include an AJAX request like

    url: "indirect_access/indirect.php",
    type: "GET",
    dataType: 'html',              
    success: function(data){      

and then I try to access, I'm prompted for a username/pass.

Is it possible to prevent htpasswd from prompting authentication for indirect access to a file via ajax?

share|improve this question
From the server's perspective, there is no difference between your 'direct' and 'indirect' request. Both are simply GET requests for a particular URL. One possible difference is the HTTP_REFERER - which you can use in your htaccess - however, it is set client side and is easy to spoof. The best approach would probably be to authenticate each request in PHP. See this question and this question for some starting points. – cyberx86 Mar 21 '12 at 0:37
@cyberx86 Thanks for the advice. I authenticate each request in PHP for *.php files in /var/www/public_html/ like /var/www/public_html/home.php and /var/www/public_html/sitemap.php. I think I'm going to have to pull all files that ajax requests are done on. – user784637 Mar 21 '12 at 0:58
I just realized your most-upvoted answer was asked by me lol – user784637 Mar 21 '12 at 1:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.