1

I have a test site running with an .htaccess file defined like so:

AuthName "test"
AuthUserFile "/home/testdomain/.htpasswds/public_html/passwd"
AuthType Basic
require valid-user

This requires a user/pass for the entire test.mydomain.com area.

I'm able to connect from almost anywhere, but for some reason, my client, who is inside a government firewall (so I'm assuming it's pretty restrictive) is NOT able to login. It keeps failing on the user/pass combo I gave them.

One oddity I don't understand is whenI mv the .htaccess file to "bak.htaccess" and they go to the site, they get through with no login screen as expected. Then I mv the file back to ".htaccess" and they close/open their browser, they're back to the .htaccess login, but now it works.

I'm not sure if this is a firewall issue on their end or a caching issue or what. Hoping there's some thing known about this that server/firewall gurus may know that I don't as a developer.

Edit: I should mention in case this has bearing: I also have a rewrite rule in place so users coming to the site from non https:// will be redirected to the appropriate page WITH https://. I have tried having the users that can't get in go to the full https://test.mydomain.com/ domain though, which should NOT trigger the rule, yet it still fails.

My rewrite info in case it's relevant:

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://test.mydomain.com/$1 [R,L]

1 Answer 1

0

If they have access to do this on their computer, you might want to see if they can try a different web browser. If they don't have admin privileges and can't install one, but it's not against their policies to do so, they could run a "portable" / standalone one which doesn't require an install.

Another workaround would be to add a "Satisfy any" line and then allow access from their IP address if that's acceptable to them from a security standpoint and they have a static IP address. If you go this route, after you do so, be sure you still get prompted for a password when accessing the site from another IP address (i.e. not their IP) in case there's some allow directive somewhere which grants access to everyone. They can get their IP by Googling "what is my ip" and seeing what comes up at the top.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .