1

I have an issue where my server is accepting a faulty password for my site.

For example, my domain name might be "johndoe.com" and the scenario is

  • ht login name: johndoe
  • ht password: johndoe123

Which works fine to log me in, however there is a small issue. For some reason I can also use my login name as the password and it will let me in! I tried using a random password but that didn't work (expected behavior).

I looked at my .htpasswd and it looks like this:

johndoe:rpFVb9n8R.p9c

So how is it that my password and my login name are both working as a correct password? This one is beyond me :/

Improve this question
1
  • Please post the relevant sections of your Apache config and any .htaccess files.
    – longneck
    Mar 1, 2013 at 14:10

1 Answer 1

Reset to default
2

It looks like you might be using crypt for your password, based on the hash. Old versions of crypt effectively only use the first 8 characters of your password, so if the shared-prefix of your username and password is longer than that, that would cause the symptoms you're seeing.

Don't use crypt, use SHA instead; run htpasswd with the -s flag, e.g.

$ htpasswd -bs /path/to/htpasswd johndoe johndoe123
Improve this answer
1
  • I've been looking for an answer for this for some time now. You are a gentleman and a scholar.
    – Jacksonkr
    Mar 1, 2013 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .