Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have added a directory to the public folder of my site and placed the following .htaccess file inside it:

AuthName "Restricted Area"
AuthType Basic
AuthUserFile /path/to/.htpasswd
AuthGroupFile /
Require valid-user

The .htpasswd file exists and has valid content.

Within the site's the public folder, there is an .htaccess file with the following rewrite rule:

RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . index.php

With this setup, my /protected folder is not protected.

  • If I leave the rewrite rule untouched, Apache doesn't seem to read my /protected/.htaccess file, and my /protected folder is not protected.
  • If I comment the rewrite out, attempted access to my /protected directory results in a password prompt, as expected.

I modified the root .htaccess rewrite rule with what I though should prevent mod_rewrite from attempting to rewrite requests to my /protected folder as below:

RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_URI} !^/protected
RewriteRule . index.php

But this seemed to have no effect:

  • The request appears to be processed by /index.php instead of prompting for authentication details as expected
  • /protected folder is not protected
  • The rest of the site works normally

There is an index.php file inside my protected folder as well (/protected/index.php), with the following content:

die('protected');

Can anyone see a problem with this approach, or with my modifications to the root .htaccess rewrite rule?

share|improve this question
    
So, is the content in /protected actually in that directory, or is is being handled by /index.php? –  Shane Madden Jul 30 '12 at 0:38
    
Ideally in /index.php, but I have placed a duplicated /index.php in /protected/index.php –  Michael Robinson Jul 30 '12 at 0:41
    
Do you need to use .htaccess? –  Shane Madden Jul 30 '12 at 0:46
    
@ShaneMadden I have no access to the vhost or any other apache config files. –  Michael Robinson Jul 30 '12 at 0:48
    
Ok! What did you mean by "requests are redirected" - are you actually getting a redirection response that changes the URL in your browser? –  Shane Madden Jul 30 '12 at 0:56
show 5 more comments

1 Answer

up vote 1 down vote accepted

Facepalm!

My rewrite conditions do work as expected, the issue was in my /protected/.htaccess file:

For basic authentication, the server writes a "401 Unauthorized" header and then looks for an error document based on a pre-defined path. Most of the time, the error document won't exist in the directory that you want to protect, so the request gets handled by the rewrite engine which throws a 404 error.

The solution was to add the following to the /protected/.htaccess files:

ErrorDocument 401 "Unauthorized Access"
RewriteEngine off

... Authorisation lines

From Conflict Between Apache URL Rewriting and Basic Authentication.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.