I have a directory that I have protected using .htpasswd/.htaccess HTTP authentication. In the .htaccess file for the directory I have this:
SSLRequireSSL <Files .htaccess> order allow,deny deny from all </Files> AuthUserFile /var/www/xyz/.htpasswd AuthName "Restricted Area" AuthType Basic Require valid-user
When I go to a page in the protected directory I am forced to https by the SSLRequireSSL directive which is as I hoped. This means that at the point that I am challenged for login credentials the browser (Firefox) address always starts with HTTPS://. This is great but the SSL indicating padlock symbol is not present until after I enter the credentials and enter the page in the protected directory.
I am worried that this could mean that the password I enter is somehow being sent before the SSL connection is formed and is therefore passed in plain text rather than SSL encoded.
Is this a valid concern? Thanks.