Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a directory that I have protected using .htpasswd/.htaccess HTTP authentication. In the .htaccess file for the directory I have this:


<Files .htaccess>
order allow,deny
deny from all

AuthUserFile /var/www/xyz/.htpasswd
AuthName "Restricted Area"
AuthType Basic
Require valid-user

When I go to a page in the protected directory I am forced to https by the SSLRequireSSL directive which is as I hoped. This means that at the point that I am challenged for login credentials the browser (Firefox) address always starts with HTTPS://. This is great but the SSL indicating padlock symbol is not present until after I enter the credentials and enter the page in the protected directory.

I am worried that this could mean that the password I enter is somehow being sent before the SSL connection is formed and is therefore passed in plain text rather than SSL encoded.

Is this a valid concern? Thanks.

share|improve this question
up vote 2 down vote accepted

No, all should be SSL encrypted. If you were using an untrusted certificate, you'd be able to observe that the certificate trust warning appears before the login prompt.

The initial 401 response that prompts for your credentials would be a 403 if it were on an unencrypted channel. Because the SSLRequireSSL is in place, you're definitely safe.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.